Claude Code's Safety Classifier Blocked 89% of Dangerous Commands. Humans Caught 14%.

In a study of 1,053 paid Claude Code testers, humans manually reviewing agent commands caught just 13.6% of dangerous ones. Anthropic’s auto-mode safety classifier caught 89%. That gap is the argument behind Anthropic’s August 7, 2026 announcement that auto mode becomes the default permission setting in Claude Code for Pro, Max, and Team plans starting August 14 — replacing per-step manual approval with a classifier that intervenes only on irreversible or destructive actions, falling back to manual review after repeated blocks in a session. Token charges for the classifier’s overhead are gone as of the announcement. Anthropic’s supporting data: real-world sessions with manual approval showed unintended harm 2.6 times more often than auto-mode sessions, and third-party prompt-injection testing found zero successful attacks against auto mode versus a 5.83% success rate against competing systems. Teams running auto mode reportedly ship about 25% more pull requests.

A companion post, published the same day, profiles Nuro, Gusto, and Garner Health running auto mode in production. Anthropic says Claude now works roughly “9x longer between interruptions” than under the prior manual-approval default. At Gusto, the classifier has blocked about 10% of session actions since mid-May 2026; employee Martin Emde has started 2,425 Claude Code sessions since December, mostly unattended jobs compiling data from GitHub, Slack, and Jira. At Nuro, staff engineer Kai Zhou runs three or four parallel auto-mode sessions at once, including overnight research agents that iterate on autonomous-driving metrics and hand him pull requests by morning. At Garner Health, 550 employees use Claude Code with auto mode wired into Salesforce, Zendesk, and Snowflake.

For companies evaluating agent seats, the practical question isn’t whether to trust an autonomous agent — it’s whether the current manual-approval habit is actually safer, or just more visible. Anthropic’s own numbers argue the opposite: a human clicking “approve” on every tool call catches less than a classifier built to watch for a narrow set of failure modes. Adobe, Nuro, Gusto, and Garner Health already default to auto mode; the August 14 change means every Pro, Max, and Team customer will too, unless they opt out.