Anthropic says that starting next week, the Claude web, desktop and mobile apps will start new sessions in auto mode on Pro, Max and Team plans. Claude Code made the same switch back in August. Now it’s coming to the apps where Claude takes real actions.
What changes
- In manual mode, Claude stops at each action and waits for you to click Allow or Deny. In auto mode, an automated check reviews each action first. Safe ones go ahead, and risky ones get blocked while Claude looks for another way or asks you.
- Anthropic says the check looks for data exfiltration and prompt injection, meaning hidden instructions in a web page or file trying to steer Claude.
- If Claude keeps hitting blocks, it falls back to asking permission for every step. It still asks before permanently deleting files in every mode.
- Plain Q&A doesn’t change. This only matters when Claude is editing files, using connectors or driving a browser.
- Enterprise stays on manual by default (admins get an email first), and Team admins can turn the new default off. You can switch back to manual any time from the selector in the message box.
- There’s also a “Skip” mode that turns off both the prompts and the checks. Anthropic only recommends it when you fully trust everything involved. I’d leave that one alone.
My take
Anthropic’s own Claude Code numbers say the classifier caught 89% of dangerous commands, while people clicking through prompts caught about 14%. I believe it. Approval fatigue is real, and after the fortieth Allow button you’re not reading anymore. A good automated guardrail beats a tired human.
But auto mode is a seatbelt, not a license. My rule for my own bots hasn’t changed: anything that sends, buys, posts or deletes gets a human yes first. Set that up in your connectors and permissions, and don’t count on any one classifier to save you.
Have a blessed day! And Happy Hacking!
