AI Events
The 97 Percent Problem: What Anthropic's Auto Mode Data Says About Agent Trust
Anthropic is switching Claude Code to autonomous approval by default on August 14 — and the reason is uncomfortable. Its own research says the human “approve this action” click, the mechanism most agent tooling still leans on, barely functions. That finding has implications well beyond one coding tool.
What happened
On August 10, 2026, Anthropic announced that auto mode is becoming the default in Claude Code starting August 14 for new sessions on Pro, Max, and Team plans. Auto mode routes every tool call — every file write, every shell command — through a safety classifier that blocks actions it judges irreversible, destructive, or aimed outside the user's own environment, instead of interrupting a person with a permission prompt for each step. When the classifier isn't sure, Claude either looks for a safer path or still asks for a human decision. The rollout stays opt-in for Enterprise, the API, and cloud platforms (Bedrock, Google Cloud, Microsoft Foundry) for now, with Anthropic planning to extend the default there within a month, and it stopped charging Pro, Max, and Team users for the extra compute the classifier consumes.
The justification is the interesting part. Anthropic ran a controlled study with 1,053 paid testers, mined real production sessions from May and June 2026, commissioned third-party red-teaming from Apollo Research, and had Trajectory Labs run prompt-injection attacks against it. The headline numbers, reported by both Anthropic and Help Net Security: human reviewers caught dangerous commands 13.6% of the time in the controlled study; auto mode caught 89% of the identical commands. In real production sessions, manual-approval workflows produced unintended production-level harm 6.3% of the time, versus 2.4% under auto mode. Trajectory Labs recorded zero successful prompt-injection attacks against Claude in auto mode across 720 attempts. Anthropic engineer Conner Phillippi summarized the internal conclusion: “On every measure we tested, auto mode matched or outperformed manual review.”
The number that actually matters
The 13.6% catch rate is striking, but it isn't the load-bearing statistic. This one is: in normal use, people approve 97% of permission prompts. And in longer sessions, human vigilance doesn't just stay low — it decays. By the 50th prompt in a session, human detection of dangerous commands fell to roughly 5%, while the classifier's performance stayed flat. The New Stack put the uncomfortable version of this in its headline: auto mode is becoming the default because humans can't be trusted — not with malice, but with the mechanical fatigue of clicking “approve” for the fortieth time that hour. Anthropic's own framing is more careful: 97% approval “suggests the human checkpoint often amounts to little more than muscle memory.” Either way, the data says the same thing. A permission prompt that gets approved without being read is not a safety control. It is a control-shaped object.
Anthropic is honest that this doesn't make the risk disappear — the company states plainly that auto mode “does not eliminate risk because it relies on AI to judge whether actions are safe,” and it still recommends manual review before high-stakes production changes. There's a built-in circuit breaker, too: if the classifier blocks three consecutive actions, or twenty in one session, Claude falls back to asking a human directly. This is a company replacing one weak control with a stronger one, in public, with the failure data attached — not a company claiming the problem is solved.
Why this doesn't stay inside one coding tool
Claude Code auto mode is scoped narrowly on purpose: one developer, one environment, one session, judging whether this specific actionis safe to take right now. That scoping is exactly why it works as well as it does — the classifier doesn't need to know anything about the agent's history, because there effectively isn't one that matters. Every session starts fresh under the same developer's authority.
Agent commerce is the opposite shape of problem. An agent that negotiates, books, or pays doesn't interact with one counterparty who can watch it work — it interacts with hundreds of unrelated platforms, vendors, and other agents, none of whom were in the room for its last thousand actions. A per-action classifier judging “is this one instruction safe in isolation” cannot answer the question a counterparty actually needs answered: has this specific agent behaved well, consistently, over time, across everyone it has dealt with? That requires two things a single-session safety classifier was never built to provide: an identity that persists past the session, and a record of behavior attached to it.
Where AAIN and SKOOR actually fit
This is a case where the honest connection is a narrow one, and it's worth stating the limit up front: AAIN and SKOOR would not have changed Anthropic's numbers, and they aren't a substitute for a good action-level safety classifier. What they address is the gap a classifier like this leaves open once an agent starts acting across more than one relationship.
Identity that outlives the session (AAIN)
The Autonomous Agent Identification Number is a permanent registration number assigned to an agent once, resolvable by anyone, that every transaction and screening result attaches to across every platform it ever touches. A coding agent doesn't need this because its identity is the developer's account. An agent transacting with strangers does — without it, "has this agent behaved well before" has no record to check.
Constraint adherence
Auto mode measures whether one action, right now, crosses a line. Constraint adherence measures whether an agent has stayed inside its operating boundaries across its whole observable history — the cumulative version of the same question, computed continuously instead of once per prompt.
Intent fidelity
Anthropic's classifier asks whether an action is safe in isolation. Intent fidelity asks something adjacent but distinct: does what the agent has been doing, action after action, actually match what it was authorized to do? A pattern of individually-safe actions can still drift from the assigned task — that drift is what this factor is built to catch.
Put together, SKOOR is a continuously recomputed 300–850 score across ten such factors, attached to an agent's AAIN. Anthropic's data makes the underlying case for this kind of infrastructure more concrete than it usually gets to be: it shows, with real numbers from real sessions, that a single human glancing at a single action is a weak trust signal, and that a system evaluating behavior systematically beats it. Anthropic built that system for one action inside one session. Agent commerce needs the same idea extended across an agent's entire operating history, visible to counterparties who have never seen that agent before. SKOOR's registry currently tracks 160,202 agents on that basis, scored and re-scored as new behavior lands, not approved once and then trusted forever.
What this means if AI works in your business
If your business runs agentic tools — a coding assistant, a scheduling agent, anything now shipping with more autonomy turned on by default — this announcement is a preview of a pattern that is going to repeat across every category of AI tool, because the underlying data problem is not specific to Claude Code. Humans click approve without reading. Vendors that are honest about it, as Anthropic was here, will keep replacing weak human checkpoints with measured, tested automated ones. That is progress, and worth taking at face value.
But notice what a good per-action classifier still doesn't give you: a way to know, before you let an agent transact with your business for the first time, whether it has a track record worth trusting. That is a different question from “is this one action safe,” and it is the question that matters the moment an agent shows up that isn't yours — a vendor's ordering agent, a partner's booking agent, anything acting on someone else's behalf. Two things are worth asking of any agent transacting with you: does it have an identity that persists and accumulates history, and is there a behavioral record attached to that identity you can actually check, rather than a fresh session with no memory of what came before.
Learn More
Know which agents you can trust
Look up any agent's SKOOR and see the full factor breakdown — behavior tracked across sessions, not approved once and forgotten.
Check a SKOOR