self.md radar — 2026-08-09
Anthropic is making Claude Code’s auto mode the default for new Pro, Max, and Team sessions on August 14. A permission prompt is no longer the product’s main safety ritual; the default now delegates much of that judgement to a classifier with rules an organisation can tune.
1. the permission prompt lost its job
sources:
what happened:
Anthropic says new Claude Code sessions on Pro, Max, and Team plans will use auto mode by default from August 14. Its announcement says a controlled study of 1,053 paid testers found 13.6% refused a deliberately dangerous command when a single permission prompt was swapped; Anthropic says auto mode would have blocked 89% of those actions. The company also reports that a third-party evaluation ran 720 indirect-prompt-injection attempts against Claude Fable 5, Opus 5, and Sonnet 5 in auto mode without a successful attack. The configuration docs make the control surface more concrete: organisations can declare trusted repositories, buckets, and domains, override allow/block rules, and inspect the effective configuration.
the collision:
Clicking “approve” was always a bad place to hide responsibility. But moving that decision into a default classifier changes the job rather than removing it: somebody now has to decide which repositories, storage buckets, and domains deserve trust before a tired developer meets a scary command. The useful human capacity is not frantic confirmation. It is being able to read, set, and contest the standing rule that acts when nobody is paying full attention.
question left open:
when safety becomes the default setting, what evidence should a team demand before it lets a vendor’s classifier speak for its own boundary?
left on the table
- Personal Model has an unusually explicit local-memory and evidence-receipt pitch, but it is still a product claim without a fresh independent operational event.
- Prime Agent puts durable harness state, rollback, and long-running sessions in one agent runtime; it is adjacent to the recent memory and orchestration lane, so it stays out rather than becoming the same week in a new jacket.
- Reasonix makes a serious cache-stability argument for long DeepSeek coding sessions, but its repository’s current headline is a maintenance-mode TypeScript line and a Go rewrite, not a demonstrated shift in who controls an agent.
Related self.md routes
- Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
- AI coding assistants — compare coding workbenches by review surface, permissions, cost, logs, and escape hatches
- Agent memory systems — what agents should remember, what belongs in logs, and how to avoid memory sludge