Anthropic Adds 'Auto Mode' to Claude Code—Entering an Era Where AI Judges Its Own Safety
In AI-assisted coding, developers have historically faced two choices: either confirm and approve every AI action one by one, or delegate all decisions to the AI. The former is safe but tedious, while the latter is fast but carries unpredictable risks. With this Claude Code update, Anthropic is attempting to eliminate this binary choice entirely. The new feature, 'Auto mode,' is currently in research preview and is a mechanism where the AI autonomously evaluates the safety of each action as it proceeds with its work.
1. What is Auto mode?—A design that shifts 'permission judgment' to the AI
1-1. The traditional binary choice and its limitations
Claude Code previously included a command called 'dangerously-skip-permissions.' As the name suggests, it is a mode where the AI operates fully autonomously, skipping all permission checks. While development speed increases, so does the risk of the AI performing unintended operations. On the other hand, the standard mode, which requires approval for every step, is safe but suffers from the problem of interrupting the developer's focus every time the development flow stops.
The new Auto mode aims for a middle ground. Before executing each action, the AI's own safety layer performs a risk assessment; it automatically executes actions deemed safe and blocks those deemed risky. The fact that 'the decision of when to ask a human for permission is left to the AI itself, rather than the user' is the fundamental difference from conventional automation tools.
1-2. Responding to prompt injection attacks
One of the threats that Auto mode detects and responds to is 'prompt injection attacks.'This is an attack method where malicious instructions are embedded within content the AI is processing, causing the AI to execute unintended actions. For example, if a hidden instruction like 'execute the following command' is included in a file the AI is processing during a code review, an AI that cannot detect it will act according to the instruction. The Auto mode safety layer has the capability to detect and block such attack patterns.
However, Anthropic has not yet disclosed the details of the 'criteria for judging safety.' Before it is widely adopted for enterprise use, the transparency of these judgment criteria will likely be demanded by the developer community.
2. The competitive context with GitHub and OpenAI—The industry-wide 'autonomy' trend
2-1. The spread of autonomous coding tools
GitHub and OpenAI also provide autonomous coding tools that perform tasks on behalf of developers, and competition in this field is intensifying. Anthropic's Auto mode is an extension of this, but its differentiator is the design policy of 'giving the AI, not the user, the authority to decide when to ask for permission.' This can be seen as an attempt to not only expand the scope of automation but also to redefine the division of labor between AI and humans.
2-2. Integration with Claude Code Review
Auto mode is not a standalone feature but is positioned as part of a series of tools recently launched by Anthropic. 'Claude Code Review' is a review tool that automatically detects bugs before code enters the production environment, and 'Dispatch for Cowork' is a feature that allows users to delegate tasks to AI agents. By combining these three, a pipeline is being formed where AI agents autonomously support the entire development cycle.
3. Current limitations and usage conditions—'Use in an isolated environment' recommended
3-1. Target models and user scope
Auto mode currently only supports Claude Sonnet 3.5 and Claude Opus 3.5, and is scheduled to be rolled out to Enterprise contract users and API users within the next few days. The 'research preview' designation means that while it is testable, it is not yet a finished product, and full-scale adoption in production environments is not yet recommended.
3-2. The important condition of an 'isolated environment'
Anthropic particularly emphasizes the condition of 'use in an isolated environment (sandbox).' This means it should only be used in an environment separated from production systems, serving as a safety measure to ensure that even if the AI performs an unexpected action, the damage does not reach the production environment. This condition reflects Anthropic's cautious stance that Auto mode is not yet at a stage where it can be fully trusted.
Summary—The design of 'autonomy and control' will become the axis of competition for AI tools
Auto mode indicates an important direction in the evolution of AI development tools. It is a shift from 'humans constantly monitoring' to 'AI autonomously judging safety and only asking humans when necessary.' While this directly leads to improved engineer productivity, it also raises new questions about how to verify and trust the AI's judgment criteria.
From the perspective of investors and business professionals, it is clear that Anthropic is positioning Claude Code not just as an auxiliary tool, but as an 'autonomous development agent.' In the competition against GitHub Copilot and OpenAI Codex, the 'breadth and safety of the scope in which AI can make its own decisions' is becoming the next axis of differentiation. While there is the challenge of ensuring transparency in decision-making criteria, the direction aligns with industry-wide trends.