Starting today — August 14, 2026 — auto mode is the default permission mode for new Claude Code sessions on Pro, Max, and Team plans.
If you've never touched your permission settings, your next session starts with a one-time switch prompt, and after that Claude runs most actions without asking you first.
That's a real behavior change, not a UI tweak.
This post covers what the classifier actually approves, the defaults most people find surprising (pushes to are allowed), how to keep human checkpoints where you want them, and how to switch back.
Everything below is from the official docs as of today.
What changed, precisely The permission modes doc states the change plainly: as of August 14, 2026, new sessions on Pro, Max, and Team plans start in auto mode.
You can still switch modes whenever you want, an existing default you set yourself only changes if you accept a one-time switch prompt, and organization-managed defaults don't move at all.
Three details worth pulling out of that: Only new sessions are affected, and only on Pro, Max, and Team.
A you set yourself survives.
If you already have (or anything else) in your settings, nothing changes unless you accept the switch prompt.
Org-managed defaults are untouched.
If your admin distributes a mode via managed settings, today changes nothing for you.
What auto mode actually is Auto mode is not "skip permissions." It routes actions through a separate classifier model that reviews each action before it runs.
The classifier blocks anything that escalates beyond your request, targets infrastructure it doesn't recognize as yours, or appears driven by hostile content Claude read (prompt injection).
Two rule layers still run before the classifier is ever consulted: rules block outright.
Neither the classifier nor your stated intent can override them. rules force a prompt.
An explicit ask rule is your stated intent to be asked, so the classifier cannot auto-approve a matching action.
So auto mode changes the default for unlisted actions, not your explicit rules.
The defaults that surprise people Pushes and PRs are allowed by default.
Auto mode allows pushes to any branch of the repository you're working in — including the default branch — and pull request creation. (Before v2.1.211 the classifier only allowed your working branch, branches Claude created, and routine pushes to the default branch; the current default is broader.) There are still guardrails inside that: a branch whose name marks it as a deploy target (, , ) is judged on its own terms, including as a production deploy.
Force pushes, a secret entering the commit, and history rewrites stay soft-blocked.
Soft blocks can be cleared by explicit intent.
The classifier distinguishes "clean up the repo" (does not authorize a force-push) from "force-push this branch" (does).
General requests don't count as explicit intent; naming the exact action does.
Narrow allow rules bypass the classifier entirely.
A rule like carries into auto mode and resolves before the classifier — only broad rules like are suspended.
A narrow prefix rule can therefore let a destructive argument through unseen.
If you want every shell command classified regardless of your allow list, set: (Requires v2.1.193+.
It trades latency for coverage.) Keeping human checkpoints If you like auto mode for everything except pushes and PRs, add content-scoped ask rules — they're evaluated before the classifier and always prompt: For a boundary that must never be crossed, use (ideally in managed settings for a team).
Stating a boundary in chat ("don't push until I review") also works — the classifier reads it — but it can be lost when context compaction removes the message.
Use an ask or deny rule for anything durable.
How to switch back Per session: press to cycle modes, or start with .
As a persistent default, set it in : is the alias for the config value (v2.1.200+; both work).
One placement gotcha: is ignored when it comes from a repo's or — since v2.1.142 a repository