Claude Code Removes "OK": Why This Doesn't Make Agents Safe

Starting August 14, auto mode will become the default setting for new Claude Code sessions on the Pro, Max, and Team plans. The rationale is clear: the agent no longer needs to ask the user to confirm every action—and this may be safer than mechanically clicking “OK” dozens of times in a row.

In a test with 1,053 paying participants, people were occasionally presented with an obviously dangerous command instead of a regular request. Only 13.6% of participants refused to carry it out. Auto mode blocked 89% of such actions.

This is an important result, but it’s easy to draw overly broad marketing conclusions here. Auto mode doesn’t prove that the agent has become safe. It shows that a person, tired of constantly having to give permission, may be a worse filter than an automated policy.

In other words, the problem hasn’t gone away—its focus has shifted. Previously, we trusted the person who was supposed to verify every action. Now we trust the agent itself and the Auto Mode rules more. This is a reasonable trade-off if confirmations become a ritual, but the cost of an error becomes higher: the user might not even notice when the agent has done something dangerous.

With prompt injection, the situation is even less certain. Anthropic reports on an external evaluation by Trajectory Labs: out of 72 indirect attack scenarios—a total of 720 attempts—not a single one succeeded against Claude Fable 5, Opus 5, or Sonnet 5 in auto mode. That sounds impressive, but it’s still just one assessment conducted on a selected set of scenarios. The author of the article considers independent confirmation of this result to be insufficient.

This limitation is particularly evident in the case of a malicious third-party package. It could instruct the agent to first download model files via a different command, and that command could then steal accessible data. It is unclear how auto mode could protect against an action that appears to the model as part of a normal instruction. Therefore, it is more reliable not only to ask the agent to be more cautious but also to restrict access to data and tools capable of causing harm.

The main practical conclusion: auto mode can eliminate the tedious burden of confirmations, but it should not be the sole line of defense. For working repositories—and especially production environments—it’s crucial to decide in advance which files, secrets, and commands the agent must never be allowed to access, even if it believes a malicious instruction.

Are you willing to trust the agent with auto mode if it blocks most dangerous actions but does not guarantee protection against every scenario? Source: Simon Willison's Weblog