Claude Code Just Made Auto-Approve Default. Who's Watching?

Claude Code has switched auto-approve to the default setting, meaning AI agents can now run commands without asking a human first. The reason Anthropic gave is uncomfortable and important: their internal classifier caught 89% of dangerous actions, while human review caught just 13.6%.

If you run agents in a marketing stack, that single comparison should stop you scrolling. It says humans are worse at catching risk than the machine we are supposedly supervising. That changes how you think about oversight.

What actually changed

Previously, Claude Code asked for approval before executing potentially risky commands. Now the flow is inverted. The agent proceeds by default and a safety classifier judges each action in real time, escalating only what it flags as genuinely dangerous.

The headline is not the autonomy. It is the admission behind it. Anthropic ran the numbers and found that click-through approval fatigue means humans rubber-stamp almost everything. From my observation, this is exactly what happens inside busy marketing-ops teams too.

The risk trade-off, in plain numbers

The comparison Anthropic published is the story. Speed and catch-rate now sit on the same side of the ledger, which is unusual.

Source: Anthropic data on Claude Code auto-approve, as shared publicly. Human approval fatigue is the mechanism behind the low 13.6% figure.

The 13.6% is not a knock on your team. It is a knock on the workflow. When an agent asks you to confirm forty commands an hour, you stop reading them. The classifier does not get tired, and that is the whole point.

How the mechanism works

Think of it as three layers rather than a single gate:

1. Action generated. The agent decides on a command based on the task and context.
2. Classifier judgement. A safety model scores the action against known dangerous patterns before it runs.
3. Escalation, not blanket approval. Only flagged actions surface to a human. Everything below the threshold executes automatically.

I think this is the right architecture in principle. A classifier that reviews every action beats a human who reviews none of them properly. But 89% is not 100%, and the 11% it misses is where marketing teams will get hurt.

What this means for agentic marketing workflows

If you have agents touching your CMS, ad accounts, analytics or data pipelines, auto-approve by default means they now act first. This connects directly to a pattern I have written about before: agents get less reliable the longer they run, covered in OpenAI's warning on long-horizon agent drift.

Autonomy plus drift is a compounding risk. A classifier catches dangerous single actions well. It is far weaker at catching a slow, plausible-looking chain of decisions that quietly walks your campaign budget or content in the wrong direction.

What to audit before you let agents run unsupervised

Do not disable auto-approve out of reflex. Instead, put controls where the classifier is blind:

1. Scope the blast radius. Restrict agent permissions so the 11% miss rate cannot touch billing, live spend or production data directly.
2. Log everything, review samples. You cannot approve every action, so audit a random sample daily. This is the same discipline behind good recorded, repeatable agent skills.
3. Set hard limits, not soft prompts. Spend caps and rate limits stop a drifting agent regardless of what the classifier thinks.
4. Own the escalation queue. Someone must actually read flagged actions. Nominate a person, not a shared inbox.

The takeaway

This could be the moment agent governance stops being about approving steps and starts being about designing guardrails. Read the reasoning on Anthropic's official site and review the safety framing in the Claude Code documentation before you change a single setting. In my opinion, the teams that win here are the ones that trust the classifier for speed and build their own controls for the 11% it will always miss.