Claude Is Switching On Auto Mode. What Will It Do Without Asking You?

Imagine asking Claude to turn a folder of interview notes into a briefing. The useful part is getting a coherent document back. Approving another routine step halfway through the job is less exciting.

Anthropic is trying to remove more of that friction. In an October 22 update, it announced that auto mode would become the default for new sessions in most Claude apps on Pro, Max and Team plans the following week.

For people using Claude to carry out longer tasks, that means more decisions about individual actions can pass to an automated safety check. You can still choose Manual.

The question is what you want Claude to finish independently, and where you still want the work handed back.

Why fewer interruptions matter

Consider a small consultancy preparing a weekly project brief. A sensible assignment might be: read these nonsensitive meeting notes, check the public sources linked in them, draft a summary and list the questions that need a person.

That is a chain of ordinary steps with a clear endpoint. Interruptions between them can erode the value of delegation. You have handed over the task but kept the job of moving it along.

Claude's unified experience brings longer Cowork-style work into the same conversation as ordinary questions. Auto fits that direction: brief the assistant on the result you want, then let it work through more of the route.

Cloud tasks can continue after you close your laptop. Work needing your local files requires the desktop app to stay open and the computer online.

Now change the consultancy's instruction: send the brief to the client and update the project records.

The work has crossed a useful boundary. A draft can be checked before anyone relies on it. A message sent in your name has already reached someone else.

Auto, Manual and Skip make different promises

The documented Cowork and Chrome permission modes govern how actions are approved:

The new unified interface documents Auto and Manual in the message box. The separate Cowork selector and Claude in Chrome also offer Skip all approvals. Anthropic advises using it only when you fully trust the tools, files, apps and other material involved.

In Auto, the safety check acts as an approver. If it rejects an action, Claude can try a safer route or ask you. Repeated blocks can return the session to human prompts, according to the Cowork guide.

It can still stop. It is simply making more of the decisions about when to stop.

The connector setting worth checking

Depending on the access you have granted, Claude can work with connected documents and apps, produce files and use browser tools. Your connections set its reach; Auto changes approval behavior within that access. Choosing Manual changes approvals only; where cloud work runs and your privacy settings stay as they were.

One detail deserves attention before you hand over a consequential task. In Cowork's connector permissions, a tool marked Needs approval can be judged automatically under Auto. It does not necessarily produce a human approval prompt. A tool marked Blocked remains denied.

If you thought Needs approval meant “always ask me before this tool acts,” that is an assumption to revisit. For something you never want a particular connector tool to do, block that tool. Review other access routes separately if Claude can also reach the service through a browser.

There is a counterintuitive wrinkle: where an Always allow preference is honored, Manual can approve a write tool directly while Auto still evaluates it. The tool's settings matter alongside the mode name.

On Team and Enterprise, write-capable connector tools need per-task approval by default, even where a member previously chose Always allow, unless an owner changes that setting. Owners can also disable Auto or change the starting mode.

What still needs care, or permission

There are concrete protections. Anthropic's Cowork safety guidance says permanently deleting files through Cowork's file tools requires explicit consent in any mode.

The rules vary by route. Claude in Chrome lists permanent deletion and financial transactions as prohibited, and requires permission for sensitive input and authorizations. Those protections apply to that browser route.

The built-in browser has site-access safeguards and action checks. Signing in there also makes that site available to Claude in later Cowork sessions on that computer. Which accounts you expose matters as much as the mode you select.

For the broader decision about persistent access and delegated work, read what to let an always-on AI assistant do.

Direct computer use deserves separate attention. In that Pro/Max beta, Claude can click and type in desktop apps after receiving app access, with no sandbox between the assistant and those applications. Anthropic's safety guide says computer use runs without the permission checks that gate other Cowork tools. Control which apps it can use and block sensitive ones; the mode selector alone is insufficient.

For the consultancy example, the useful first handoff is the finished brief. Sending it and changing client records can remain a separate, supervised task.

Why Anthropic trusts automated approval

There is a reasonable argument behind the change. Repeated approvals can become a reflex. Anthropic's engineering account of Claude Code Auto describes permission fatigue as a problem the system was designed to address.

The coding system has undergone vendor testing and external red-teaming by Apollo Research. That work provides evidence worth examining, including attacks that led to improvements.

The distinction is the product tested. Anthropic explicitly says the numerical safety findings in its default-change announcement concern Claude Code. They do not establish an equivalent success rate for your inbox, browser or office documents.

An action passing a permission check also says nothing conclusive about whether the resulting brief is correct. You still need to inspect the work you intend to use.

How to switch back to Manual

In the unified Claude experience, open the permission selector in the message box and choose Manual. The setting applies to the conversation and can be changed while you work. Anthropic documents Enterprise's default as Manual.

For Pro and Max, plan to check the selector in each new conversation. Auto is the documented starting mode, and Anthropic's current unified-experience guide describes no personal setting that makes Manual the default for future conversations.

In separate Cowork, use the mode selector in the chat box and choose Manually approve. Chrome's Cowork side panel explicitly remembers a changed mode for future sessions.

Web, desktop and mobile are part of the rollout, but accounts can receive the unified interface at different times. The official guidance supports the message-box selector; it does not establish one identical sequence of mobile taps for every version. If Auto is missing in a work account, an administrator may have disabled it.

There is also a usage consequence to longer delegation. Multi-step work, tool use and file creation consume allowance. Check Settings > Usage when trying longer assignments to see how much of your plan they use.

Choosely's take

Auto is a sensible starting point for a well-defined task whose result you can inspect: research, a draft brief, a comparison or a work product prepared from a bounded set of inputs.

Keep closer oversight when the task starts speaking for you, changing important originals or acting in accounts where a mistake is difficult to undo. Choose Manual for the approvals it governs, and limit access where you need a stronger boundary.

The worthwhile promise is that Claude can finish more of the job. Decide what “finished” means before it starts.