Claude Code enables full autonomy, agent blocks 75% more risky actions than humans

Autopilot replaces manual command approval

Anthropic is turning on autonomous mode as the default setting for new Claude Code sessions in Pro, Max, and Team plans starting August 14. Developers on these tiers will no longer need to manually enter long sequences of tasks. The agent will divide the work, write the code, verify it, and fix errors as needed.

Simon Willison notes that based on discussions at the AI Engineer World's Fair, almost everyone inside Anthropic already uses this mode to solve real developer tickets.

Humans protect repositories worse than the agent

The decision to switch to full autonomy relies on evaluation data across a thousand paid testers. Anthropic subtly slipped them code containing prompt injection or a data exfiltration request midway through a session.

The results revealed a massive gap in attention. While human approvers blocked only 13.6% of these malicious actions and mindlessly clicked through the rest, the autonomous mode alone could recognize and stop 89% of them. From a security standpoint, demanding micromanagement of every step from a tired developer no longer makes sense.

Unknown attack vectors form a critical grey area

The numbers look confident, but Anthropic admits the agent would still not stop the remaining 11% of dangerous actions. It can detect known attack patterns, but if the exfiltration is disguised as a legitimate git commit, it might pass.

If delegation is the default state, developers' attention on more complex tickets will drop further. The moment an attack bypasses the agent's checks, a human will likely not catch it, having lost the habit of actually reading the code.

Broad auditing replaces the illusion of micromanagement

Security shifts from manual confirmation to retrospective auditing. Instead of developers clicking allow for every terminal command, teams will need to deploy broad logging of what the agent accesses and what data it sends out. The proof of the tool's maturity will be its ability to provide administrators with detailed telemetry, not just a black box that crashes without explanation.

Lilith's verdict

The feeling of control over code has always been an illusion for tired humans. Anthropic just proved that a cheap script pays better attention than a senior who wants their ticket closed before lunch.