Claude Code 将默认启用 Auto Mode——因为人类无法被信任

在 Claude Code 的早期阶段，用户似乎只能在两种选择之间二选一：要么批准编程 Agent 执行的每一项操作——这非常烦人；要么给它完全的自主权——这又极其危险。

今年早些时候，Anthropic 推出了 auto mode。该模式利用一个独立的分类器模型，让 Claude 决定某项操作是否危险到需要人工干预。

从 8 月 14 日起，这将成为新的默认设置：适用于 Pro、Max 和 Team 用户。Enterprise 用户、Claude API 以及云平台目前仍需主动选择开启，但这些平台也计划在未来一个月内推出默认启用方案。原因在于，事实证明，人类在被持续要求确认权限时表现并不理想。

97% 的问题

事实上，Anthropic 自己的研究显示，用户目前会批准 97% 的权限提示。

Anthropic 指出：“虽然大多数提示可能都对应安全、常规的命令，但如此高的批准率表明，许多用户是在条件反射式地点击通过，而非逐项审查每条命令。”

图片来源：Anthropic

团队与超过 1,000 名测试者合作后还发现，人类仅识别出 13.6% 的危险命令，而启用 auto mode 的 Claude Code 识别出了 89%。

会话持续时间越长，人工测试者的表现越差。在经历 50 次提示后，测试者仅发现了 5% 的危险命令（不过尚不清楚 Anthropic 是否在这些长时间测试中给他们提供了咖啡）。

事实证明，人类在被持续要求确认权限时表现并不理想：在经历 50 次提示后，测试者仅发现了 5% 的危险命令。

Anthropic 认为，看到更少的权限提示，意味着用户将能花更多时间真正阅读和评估那些仍会出现的提示。

在实际运行中，当分类器标记某条命令时，auto mode 会直接阻止它，而不是请求权限。随后，Claude 通常会寻找完成同一任务的更安全方法，或者向用户请求明确批准。

该机制也设有回退方案：在连续三次操作被阻止，或单个会话内累计阻止二十次之后，auto mode 会将控制权交还给用户，并恢复为手动批准模式。

正如 Anthropic 所指出的，如今 Agent 往往会工作更长时间，auto mode 让用户可以更轻松地运行这些持续数小时的任务，而不必花上数小时只是看守机器人。

强化 Auto Mode

在此次发布前，Anthropic 也投入时间强化 auto mode。

其中最重要的改动是硬性拒绝规则（hard denies）。Anthropic 表示，该分类器被设计为绝不批准数据外泄行为，例如将代码或机密信息发送到外部目的地。若要执行此类操作，开发者必须退出 auto mode，或自行运行该命令。

组织还可以为绝不希望被允许的操作添加自己的硬性拒绝规则，即使用户明确要求执行这些操作也不例外。

该分类器现在还载有关于如何访问和共享机密及保密数据的明确规则。

该分类器现在还载有关于如何访问和共享机密及保密数据的明确规则；并且会在操作运行前，检查 git push 或拉取请求的目标地址属于公开、私有还是受信任状态。毕竟，同一次推送究竟是常规操作还是数据外泄，取决于其最终发送到何处。

此外，在执行诸如 git reset --hard 的破坏性命令之前，分类器现在会查看仓库的 Git 状态，因此 auto mode 能够了解哪些未提交的工作将被丢弃。API 侧的探针还会筛查 Claude 从网页、文件和工具输出中获取的内容是否包含提示注入尝试；一旦发现异常，便会在 Claude 的上下文中添加警告。

为对这些改动进行压力测试，Anthropic 与 Apollo Research 开展了一项为期两周的红队试点，在真实工作流中注入合成攻击。强化前，分类器漏掉了其中 12% 的攻击；强化后，在留出测试集上，这一比例降至 7%。

Auto Mode 与提示注入攻击

Anthropic 也借此机会将自己与最大竞争对手 OpenAI 进行比较。当然，如果结果不佳，该公司不会这么做；但 Anthropic 确实委托了第三方测试 auto mode 防御提示注入攻击的效果。

Trajectory Labs 发现，在 Anthropic 模型启用 auto mode 时，其尝试的 720 次攻击无一成功通过；即使完全绕过权限机制，Claude Sonnet、Fable 和 Opus 5 也仅放行了 0.09% 的攻击。

OpenAI 的 GPT-5.6 Sol 在 Codex 的完全访问模式下放行了 19% 的全部攻击；在其自动审查模式下，这一比例略低于 6%。

图片来源：Anthropic。

不过，Anthropic 自己也指出，auto mode 是一个分类器，而不是保证——它能降低风险，但不能消除风险。对于对生产基础设施进行的高风险变更，该公司仍建议保留人工参与。

额外功能：Claude Code 会话现在可以互发私信

除这项权限更新外，Anthropic 还在周五宣布：如果用户同时运行并行的 Claude Code 会话，这些会话现在可以相互通信。这在多个会话处理相关问题、且需要彼此告知其正在修改的代码变更时尤其有用。

Anthropic 在 X 上解释道：“你不必再在另一个会话中重新解释自己的需求，现在可以让 Claude 来做这件事。它会发送一份摘要——不会发送你的历史记录或文件——而另一个会话可以在任务进行到一半时接手。”

In the early days of Claude Code , it felt like you either had to approve everything the coding agent did — which was incredibly annoying — or give it free rein, which was incredibly dangerous.

Earlier this year, Anthropic introduced auto mode, which uses a separate classifier model to allow Claude to decide when something is so dangerous that human intervention is needed.

Starting August 14, that will become the new default for Pro, Max, and Team users (it remains opt-in for Enterprise users and on the Claude API and cloud platforms for now, with a default rollout there planned within the next month), because, as it turns out, humans don’t do so well when constantly prompted for permissions.

The 97% problem

Indeed, as Anthropic’s own research shows, they currently approve 97% of permission prompts.

“While most prompts are likely for safe, routine commands, an approval rate that high suggests many users are clicking through reflexively rather than reviewing each command,” Anthropic notes.

Credit: Anthropic

Working with more than 1,000 testers, the team also found that humans only caught 13.6% of dangerous commands, while Claude Code in auto mode caught 89%.

The longer the sessions continued, the worse the human testers performed. After 50 prompts, the testers only found 5% of dangerous commands (though it’s unclear if Anthropic provided them with coffee during those long sessions).

As it turns out, humans don’t do so well when constantly prompted for permissions: After 50 prompts, the testers only found 5% of dangerous commands.

Anthropic argues that seeing fewer permission prompts means users will spend more time actually reading and evaluating the ones that do come through.

In practice, when the classifier flags a command, auto mode blocks it instead of asking for permission. Claude will then typically look for a safer way to accomplish the same task, or come back to the user for explicit approval.

There’s a fallback, too: After three consecutive blocks, or twenty in a single session, auto mode hands control back to the user and reverts to manual approvals.

As Anthropic also notes, with agents now often working for much longer periods, auto mode makes it far easier to run these multi-hour tasks without having to spend hours doing nothing but botsitting.

Auto mode on hard

Ahead of this launch, Anthropic also spent time hardening auto mode.

The most consequential of these changes are the hard denies. Anthropic says the classifier is designed to never approve data exfiltration, like sending code or secrets to an external destination. To run an action like that, a developer would have to switch out of auto mode or run the command themselves.

Organizations can also add their own hard deny rules for actions they never want allowed, even when a user asks for them.

The classifier now also carries explicit rules for how secrets and confidential data can be accessed and shared.

The classifier now also carries explicit rules for how secrets and confidential data can be accessed and shared, and it checks whether the destination of a git push or pull request is public, private, or trusted before the action runs. The same push, after all, can be routine or an exfiltration depending on where it lands.

In addition, the classifier now sees a repository’s git status before destructive commands like git reset –hard, so auto mode knows what uncommitted work is about to be discarded, and an API-side probe screens content Claude pulls from web pages, files, and tool outputs for prompt injection attempts, adding a warning to Claude’s context when something looks off.

To pressure-test this work, Anthropic ran a two-week red-teaming pilot with Apollo Research, which injected synthetic attacks into real workflows. Before the hardening, the classifier missed 12% of these attacks; afterward, that number dropped to 7% on a held-out test set.

Auto mode vs. prompt injections

Anthropic is also taking this chance to compare itself with its biggest competitor, OpenAI. Of course, the company wouldn’t do this if the results weren’t good, but Anthropic did commission a third party to test how well auto mode fared in preventing prompt injection attacks.

Trajectory Labs found that with Anthropic’s models in auto mode, not a single one of the 720 attacks it tried got through (and even with permissions fully bypassed, Claude Sonnet, Fable, and Opus 5 only let through 0.09% of attacks).

OpenAI’s GPT-5.6 Sol in Codex let 19% of all attacks through in full access mode and just under 6% in its auto-review mode.

Credit: Anthropic.

Still, Anthropic itself notes that auto mode is a classifier, not a guarantee — it reduces risk, it doesn’t eliminate it. For high-stakes changes to production infrastructure, the company still recommends keeping a human in the loop.

Bonus: Claude Code sessions can now DM each other

In addition to this permissions update, Anthropic also on Friday announced that if you run parallel Claude Code sessions, they can now talk to each other. That’s especially useful if you have multiple sessions that are working on related problems and they need to tell each other about changes to the code they are working on.

“Instead of having to re-explain yourself in another session, you can now tell Claude to do it. It sends a summary (not your history or files), and the other session picks it up mid-task,” Anthropic explains on X.

YOUTUBE.COM/THENEWSTACK Tech moves fast, don't miss an episode. Subscribe to our YouTube channel to stream all our podcasts, interviews, demos, and more. SUBSCRIBE

Group Created with Sketch.