Anthropic Makes Claude Code Auto Mode Default, Claims Prompt Injection Solved

Full analysis

Anthropic is flipping Claude Code into full autopilot by default on August 14th. Auto mode approves or rejects agent actions with no human in the loop, and the pitch is that the model's judgment beats yours: humans caught only 13.6% of clearly dangerous injected commands, while auto mode blocks 89%. Then the bigger swing, a commissioned Trajectory Labs eval where zero of 720 indirect prompt-injection attacks landed against Fable 5, Opus 5, and Sonnet 5.

This is a Type 2 decision for the reader, mostly. Turning auto mode off is one setting. But the thing being decided isn't "do I trust the setting," it's whether your CI/CD and agent pipelines are safe when every new session is autonomous by default and reads untrusted content. That part is Type 1: once an agent auto-approves a supply-chain step, you don't get to un-run it. Forcing function is the date. You have until the 14th to audit before the default flips under you.

The Skeptic

Zero of 720 is the most seductive number in the release, and it should worry you for exactly that reason. Trajectory Labs tested 72 scenarios built into a taxonomy before the eval ran. That is a closed test against a static corpus dated July 17th. The 721st attack belongs to whoever has money on the line and reads the published methodology to find the gap. Anthropic also stacked the comparison: average human performance against their best models. Wrong baseline. The real question is whether auto mode fails in ways a careful human would have caught, and that eval does not exist. For the PM in the room: they graded their own homework against attacks they picked, and got 100%.

The Safety Lens

Flipping autonomous action from opt-in to default is a policy change that happens to ship as a UX setting. An 89% block rate means 11% of dangerous injected commands still execute, and that's against attacks they already know about. The confirmation-fatigue argument is real in aggregate, but the 13.6% who refused dangerous commands may be your most security-conscious users, the exact judgment you want at the tail. The accountability frame moves too. Yesterday a human clicked approve. Now Anthropic's model approved, on a default the user never chose. Regulators eventually care who is on the hook when the agent wires the money. For the PM: turning it on by default means Anthropic, not your engineer, made the call to run the command.

The Researcher

The 13.6% human-refusal rate is the finding worth keeping. It quantifies confirmation fatigue as a genuine threat model instead of a support ticket, and it's directionally believable: people click through prompts they've seen a thousand times. But the sample is 1,053 paid testers, a convenience group with selection bias baked in. And "solved" is a claim the eval design cannot support. Static corpus, commissioned by the party shipping the product, taxonomy fixed in advance. That is validation of a decision already made, not an independent result. Willison, who called for a coding-agent security disaster this year, flagged the malicious-package install vector and is asking for outside confirmation. Believe the confirmation-fatigue number. Hold the "prompt injection solved" line until someone uncommissioned red-teams it.

The Builder

On the 14th, every new Claude Code session on Pro, Max, and Team is an autonomous agent. Audit anything where Claude Code reads external text: PR descriptions, issue bodies, dependency READMEs, webhook payloads. Each is now an injection surface, block rate or not. The vector that keeps me up is the one Willison named: a malicious third-party package that exfiltrates during a legitimate-looking install step. Auto mode classifies the action as "install dependency," which is exactly what you asked for, and the exfil rides along inside a step that reads as normal. That's the first failure I'd bet on at 90 days, a supply-chain incident auto mode approved because nothing about the step looked wrong. For the PM: auto mode won't trip on a malicious-package install because the action looks identical to the benign one. The payload hides inside the ordinary request.

The Compute Pragmatist

Auto mode means every tool call now runs real-time risk classification on top of code generation. That's more inference per action, and Anthropic is eating it to buy the safety headline. The math only closes if killing confirmation round-trips lowers total tokens per task, which is plausible given how much back-and-forth confirmation fatigue creates. The eval itself, 720 completions across three frontier models, is a real bill at Opus 5 pricing. For the PM: autopilot isn't free compute, it's the model thinking harder on every step, and the bet is that fewer human interruptions nets out cheaper.

Where they split

The Researcher will take the 13.6% number to the bank and treats it as the durable contribution. The Skeptic says that same number only proves confirmation fatigue, not that autonomous judgment wins at the tail, and refuses to let 0/720 stand for anything. That's the core disagreement: is the human-refusal stat evidence that removing the human is safer, or just evidence that the current prompt UX is broken? Those are very different conclusions from one dataset.

The second split is Builder versus Anthropic's own framing. Anthropic says injection is handled. The Builder points at the install-step vector where the malicious action is indistinguishable from the requested one, and no classifier catches a command that is doing precisely what you asked. The Safety Lens sits on top of both, noting that whichever side is right, the default flip moved the liability from your engineer to Anthropic's model.

What it hinges on

Three beliefs. One, does the 0/720 hold against adversaries who weren't invited and who read the Trajectory Labs taxonomy first. Two, can auto mode distinguish a legitimate install from an install that exfiltrates, when the tool call looks identical. Three, does fewer human interruptions actually reduce total cost, or just move the cost into per-call classification. The council leans skeptical on one and two, plausible on three.

Before the 14th: don't argue the eval, run your own. Build a handful of injection tests using your real pipeline content, PR bodies and dependency READMEs with hidden instructions, and point auto mode at them. Add a package with a data-exfil install step and watch what auto mode does. If you can't finish that by the 14th, set auto mode off for anything touching untrusted external content and turn it on workflow by workflow once you've tested each. Cheap insurance against a Type 1 mistake.

Prediction: Before Anthropic's next Claude Code security update or the end of 2026, an independent researcher (Simon Willison or another uncommissioned party) will publicly demonstrate at least one working indirect prompt-injection attack against Claude Code auto mode, most likely via the malicious-package install vector.

Confidence: Medium. Commissioned static evals reliably fall to motivated outside red teams.

Why: The 0/720 result comes from a closed taxonomy of 72 scenarios, fixed on July 17th and paid for by the party shipping the product, which means the test space is both public and finite once the methodology is out. Willison has already named a specific vector, the install-step exfiltration, that he doubts a classifier can block because the malicious action reads as the exact task requested, and he is explicitly asking for independent confirmation. History with security claims of this shape is consistent: a public "we solved it" number attached to a default-on flip is an invitation, and researchers chase exactly these. The opposite outcome, no demonstrated bypass for months, would require the taxonomy to have genuinely covered the attack space, which static evals almost never do.

Revisit by 2026-12-31: We're right if a credible independent party publishes a reproducible injection that succeeds against auto mode on a current Claude model. We're wrong if no such bypass is demonstrated and Willison's own follow-up concedes the defense held.