Anthropic’s detailed engineering post on making Claude Code’s auto mode the default — and the safety data that justifies it. The headline number is stark: in a controlled study with 1,053 paid testers, humans caught only 13.6% of dangerous commands, while auto mode blocked 89%. Manual review has become habitual — users approve 97% of permission prompts — and 49.5% of active users have already created Bash allow-rules that effectively bypass the permission system. Auto mode replaces that cycle with a classifier that blocks irreversible or destructive actions before they run, and when it blocks something Claude either finds a safer path or asks for approval. The data on real-world usage is just as damning: manually-approved sessions contained serious unintended harm more than twice as often as auto mode sessions. A third-party evaluation by Trajectory Labs found zero successful prompt-injection attacks out of 720 attempts against Claude models running auto mode, versus 5.83% for GPT-5.6 Sol in Codex’s equivalent mode. The piece also covers three real incidents auto mode prevented at Anthropic — an off-network data leak, a mass pod kill that would have torn down training jobs, and an over-broad privilege escalation — and describes how teams at Adobe, Nuro, Gusto, and Garner Health are already running auto mode in production. The deeper argument is that the permission-prompt model of AI safety is fundamentally broken: it asks humans to make hundreds of security decisions per session, under a context-switching penalty, and the data shows we fail at it. Auto mode is a recognition that the gatekeeper cannot be the person who is also trying to get work done.