What jumps out to me is not the feature itself, but the confidence move Anthropic is making by turning it on by default for paid Claude Code users. That is a pretty strong signal: they think the classifier is good enough that the friction of repeated approvals is now the bigger problem than the risk. I’m not fully convinced that’s true for everyone, because “safe enough for default” and “safe enough for unattended work” are very different claims.
The part that actually makes sense is the productivity argument. If you’ve ever watched an agent grind through a task while waiting for you to click approve fifty times, you know how much momentum gets destroyed by the permission loop. For real coding sessions, especially the long-running ones Claude Code is clearly pushing toward, the manual gate can become theater. A classifier that catches obvious destructive or out-of-bounds actions is probably better than fatigue-ridden human rubber-stamping.
But the study numbers in the article are the bit I’d treat carefully. The comparison between people catching 13.6% of dangerous commands and the classifier catching 89% sounds dramatic, but I’d want to know the exact setup before drawing big conclusions. What counted as “dangerous”? How realistic were the prompts? Did testers know they were being evaluated? Those details matter a lot, and without them this is directionally interesting but not enough to make me trust the system in production.
I also think the “small number of extra tokens per tool call” detail is easy to miss but important. Anthropic removing that charge suggests they were at least aware the classifier overhead was becoming a user-visible tax. That’s the right trade if they want auto mode to feel like the normal path instead of a premium annoyance.
The really sane sentence in the whole piece is the caution about human review for production changes. That’s where I’d draw the line too. Let the agent run free for scaffolding, refactors, tests, maybe even mundane repo work. But if the session is touching deployment, secrets, or anything irreversible, I’d still want a human in the loop. Auto mode can reduce friction. It cannot, and probably will not, eliminate judgment.
The comparison to OpenAI opting out of auto mode for a more powerful model is interesting, though I’d be careful not to overread it. Different teams draw the safety line differently, and those defaults often reflect product philosophy as much as model capability. Still, it does show Anthropic is willing to be a bit bolder here.
Reference: PSA: Claude Code enabling auto mode as default next week, Anthropic says - 9to5Mac
