97% of Your AI Approval Clicks Were Reflexes 🤖

Anthropic ran a study with 1,053 testers before making a call most tools never make honestly about their own permission model: the approval prompt was not working, and here are the numbers to prove it.

Auto mode, the classifier that decides which tool calls need a human, caught 89% of harmful actions in that study. Humans clicking through the old per-call approval prompt caught 13.6%. And 97% of those prompts got rubber-stamped without a second look, whether the action was harmless or not.

Starting August 14, new Claude Code sessions on Pro, Max, and Team plans switch from "ask before every tool call" to "route through a classifier, only interrupt for irreversible, destructive, or outward-facing actions." Enterprise, API, and cloud-partner deployments (Bedrock, Vertex, Foundry) stay opt-in for now, with a default flip planned there within the month. Classifier overhead is not billed separately.

The 97% number is the actual story

A permission prompt only works as a safety mechanism if the human reading it is actually evaluating each one. At 97% rubber-stamped, that was not happening. People were clicking yes on reflex, the same way you click through a terms-of-service dialog. The prompt was theater. It gave the appearance of oversight without providing any, and the one time it mattered, the reflex fired the same as every other time.

This matters beyond Claude Code specifically. Any tool that gates action behind a per-call human approval and expects that approval to be a meaningful check is making the same bet Claude Code just admitted it lost. If your CI pipeline, your deploy tooling, or your own internal agent framework has a "click to confirm" step that nobody actually reads anymore, this study is a preview of what an audit of your own approval logs would probably show.

What "irreversible, destructive, outward-facing" likely means in practice

Anthropic has not published the exact classifier boundary, but the categories map to what teams running agents in CI already learned to gate manually:

• Irreversible: force-pushes, dropped database tables, deleted branches, anything git reset --hard adjacent.
• Destructive: bulk file deletion, overwriting uncommitted work, rm -rf on anything wider than a scratch directory.
• Outward-facing: pushing code, opening or closing PRs, sending messages to Slack or email, posting to external services, anything visible to someone besides the person running the session.

If you already run Claude Code with a pinned permission mode (auto-accept, plan mode, a custom allowlist), none of this changes for you. This only affects sessions that were relying on the default, which was most sessions belonging to people who never touched the setting.

The honest trade-off

A classifier is not you. It was trained on what 1,053 testers, in aggregate, considered harmful. It was not trained on your specific codebase, your specific generated/ folder that looks disposable but is not, or the one script in your repo where a "routine" bulk delete is actually catastrophic.

89% caught is an average across a study population, not a guarantee for any individual team's blast radius. A destructive action that looks routine in general (deleting files in a folder named tmp or build) may not trip the classifier even when, in your repo, that folder is load-bearing. Conversely, something narrow and specific to your setup that the classifier has never seen might get flagged when it is actually fine.

If you run agents against infrastructure with unusual failure modes, the safe move is still to pin an explicit permission mode rather than trust the default classifier to have learned your repo's edge cases. The classifier reduces the average number of things you have to think about. It does not remove the need to think about the things that are specific to you.

What actually shifted

This was framed as a UX improvement, fewer interruptions, faster flow. The more accurate framing is that Anthropic looked at its own approval funnel, found it was not catching anything a human was not already rubber-stamping, and moved the actual judgment call from a human reflex to a trained classifier. That is a better bet on the numbers given here. It is not the same as saying the judgment call is now being made well for every possible repo, it is being made by something with a measured track record instead of something with none.

Teams already running Claude Code semi-autonomous in CI or across a fleet of agents were building workarounds for exactly this gap. This is Anthropic catching up to how those teams were already using the tool, not adding a new capability.

Were you already running Claude Code with a pinned permission mode before this? What did you have to build around the old approve-every-call default?