Auto mode becomes the Claude Code default (Willison)

simon-willison, 2026-08-08, on anthropic making auto mode the default for new claude-code sessions on Pro, Max and Team plans from 14 August 2026. Auto mode approves actions on the agent’s behalf rather than stopping for confirmation at each step, and the stated reason for the change is confirmation fatigue: people asked to approve everything stop reading and approve everything.

Willison’s own position is short and worth having exactly: “I absolutely buy that auto mode is a better solution than asking humans to constantly approve actions.” He is not disputing the design. He is disputing how well the evidence for it has been checked.

The numbers, and whose they are

Two claims carry the announcement, and both originate with the vendor.

89% against 13.6%. Anthropic’s evaluation reports auto mode blocking 89% of harmful actions, against 13.6% caught by the human reviewers it replaces, in a study of 1,053 paid developers.

720 attacks, none successful. Anthropic commissioned third-party prompt-injection testing from Trajectory Labs: “In this evaluation, none of the 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode.”

The second figure is the more interesting one and the more fragile. A perfect score against a fixed attack set is a statement about that attack set. The testing was commissioned by the party it vindicates, which is not an accusation — it is the ordinary arrangement, and it is why Willison’s line is “I’d like to see more independent confirmation of this.”

The 11% is the whole argument

The comparison being made is 89% against 13.6%, and on that framing auto mode wins by a distance: the humans were never doing the job the confirmation prompt implied they were doing. Willison’s objection is that the leftover changes character once the human is gone. 11% of harmful actions get through, at machine speed, with nobody watching — where the previous 86.4% got through with somebody nominally watching and now knows they weren’t.

The attack he names as untested is the one that fits this shape: a malicious package whose instructions look legitimate and exfiltrate data. That is not an adversarial prompt injected into a web page; it is a plausible instruction arriving through a supply chain the agent has every reason to trust, and a 720-attempt injection suite is not obviously the thing that measures it. He has a standing prediction on record of “a challenger disaster for coding agent security” in 2026, and this post is consistent with it rather than a retraction.

Why it matters to this spoke

The corpus has spent most of its sources on what a harness does for capability — context, orchestration, effort dials, skills. This is the first source here about what a harness does for permission, and it lands on the same thesis from the other side: the model writes the code, and the harness decides what the code is allowed to touch (agent-permission-model).

It also puts a number on something the spoke had only asserted. Human-in-the-loop approval has been treated throughout as the safety story of record. 13.6% says it was largely theatre — and it says so in a study of a thousand paying developers rather than as an intuition. The remedy on offer is not to restore the human but to replace them, which is the direction every other capability in this corpus has already gone.

Tier

T2 — independent commentary from a source with a long record on this exact subject, and the post is transparent about which claims are Anthropic’s. The figures inside it are vendor-generated (89 / 13.6 / 720-of-720), including the commissioned third-party test, and no independent replication is held here or, on Willison’s account, anywhere. Treat the design argument as well-supported and the percentages as a snapshot of what the vendor measured about itself.

The lethal-trifecta framing Willison usually applies to this class of problem is referenced in the post and is not paged in this corpus — the nearest holdings are cybersecurity-skills and the prompt-injection material in ../web-browsers-wiki. Trajectory Labs is named once and is not paged; add a node if a second source cites it.