This week Claude Code's auto mode becomes the default for most Claude Code users. I think that's the right call — and the number Anthropic published to justify it is the most useful thing I've read about agent safety all year:
"Claude Code users approve 93% of permission prompts."
Ninety-three percent. If you approve 93% of anything, you are not reviewing it. You are clearing it. The per-command human checkpoint had already stopped being a control; it had become a speed bump that trained you to tap "yes" faster.
So swapping it for a classifier isn't a lowering of standards. And Anthropic is refreshingly blunt about that classifier's limits:
"The 17% false-negative rate on real overeager actions is the honest number."
83% caught, by something that doesn't get bored on the four hundredth prompt, measured against a human baseline of "approves 93% of everything." I'd take that trade.
But there's a line further down the design that I haven't seen anyone talk about, and it's the one that actually changed how I run agents:
"If a session accumulates 3 consecutive denials or 20 total, we stop the model and escalate to the human."
That is correct engineering. When the classifier keeps saying no, something is wrong at a level a classifier shouldn't be resolving by itself. Stop, and go get a person.
The problem is what that sentence quietly assumes.
An escalation is a rendezvous
"Escalate to the human" is not an action the system can complete on its own. It is half of a handshake. It works only if a human is actually reachable at that moment.
And here is the paradox baked into a good autonomous default: the entire value of auto mode is that you stop watching. That's the point. Fewer interruptions, longer unattended runs, agents that keep working while you do something else.
Which means the moment the agent stops and asks for you is, almost by construction, the moment you are least likely to be sitting in front of it. You didn't wander off despite auto mode. You wandered off because of it.
Under the old model you got a hundred low-stakes prompts and you were present for all of them. Under the new one you get very few prompts, each carrying far more weight, and no particular reason to be at the desk when one fires.
The number of approvals went down. The cost of a missed approval went up.
The failure mode is boring, which is why it bites
Nobody's Mac catches fire. What happens is duller and more expensive:
- The run parks. Three denials in a row, the model stops, and the session sits holding its context until you come back — an hour, a lunch, a night.
- The rendezvous window closes. Sessions don't wait forever. You return to a stopped agent, a half-applied change, and the job of reconstructing what it was in the middle of.
- You rubber-stamp on catch-up. This is the worst one. You come back to a stopped session, you're behind, you have no memory of the state that produced those denials, and you clear them to get moving again.
That last one is the real risk of getting this wrong. That's the 93% reflex — except now it's pointed at the small set of actions a classifier already flagged as worth stopping for.
Auto mode filtered out the noise beautifully. But if the signal that survives the filter reaches you at the moment you're least equipped to judge it, you haven't removed the risk. You've concentrated it into the exact decisions you're most likely to fumble.
The thing worth designing now
Approval volume was the old problem, and it has been solved better than most of us would have solved it ourselves. Approval reachability is what's left, and it is now load-bearing in a way it wasn't when prompts were constant and you were always there.
Two questions worth asking about any setup running unattended after this week:
1. When it stops and asks, where does the ask physically appear? For most of us the honest answer is: on the machine running the agent. If that's a Mac at home and you're not at it, the ask has nowhere to go. It isn't lost, exactly. It's addressed to an empty chair.
2. What is the declared behavior when nobody answers? Not the theoretical answer — the configured one. "Wait indefinitely" is a choice. "Pause cleanly" is a different choice. Most setups have never made either one explicitly; they inherit whichever one happens by accident and find out which it was afterwards.
If you can't answer both, you don't have an autonomy problem. You have an on-call problem — and unlike your services, this pager has no routing rules.
What I'm building, and what it doesn't do
Disclosure: I build ThumbGate, so weigh the next two paragraphs accordingly. I'd rather be precise about the boundary than oversell it.
It does not replace or second-guess auto mode's classifier. Nothing I've built would catch a dangerous command better than a purpose-built classifier does, and I'd be skeptical of anyone claiming otherwise two days after the feature shipped.
What it does is the unglamorous half: a no-cost, browser-based control plane for the machines running your agents. Pair a Mac once — no inbound ports — and from any browser you can see which machines are connected, steer the agents on them, and set explicitly what should happen when a machine goes offline, rather than finding out later. Leash approvals themselves stay on the paired Mac while it is online; the remote approve/deny surface is the phone app. That is the honest division of labor, not a claim that a web page is holding your gate.
That's it. It's new, it's mine, and at this stage I would genuinely rather have five people tell me the model is wrong than a hundred drive-by visits from people who never pair a machine.
- Pair a machine: https://thumbgate.app/?utm_source=devto&utm_medium=zyvop&utm_campaign=evening_20260812&cta_id=zyvop_evening_devto_app
- Approvals on your phone: iOS - Android
No affiliation with Anthropic. (And no relation to Nous Research's Hermes model line — that name collision is mine to live with.)
Sources: Anthropic, "How we built Claude Code auto mode"; The Register, "Claude Code puts auto mode in the driver's seat".
If you're running agents unattended after Friday: what does your setup do when the model stops and asks, and you're not there? I don't think most of us have actually decided.
Top comments (0)