Claude Code 5天后默认开启自动模式，多花的钱Anthropic自己掏 Claude Code Will Enable Auto Mode by Default in 5 Days; Anthropic Covers the Extra Cost
Anthropic 宣布 5 天后 Claude Code 默认启用自动模式，分类器额外 token 成本由官方承担；文章披露人工审批同意率、受控实验、对抗测试和三个真实拦截案例。 Anthropic will make auto mode default in Claude Code in five days, absorbing the extra token cost for the safety classifier while backing the decision with controlled tests, production data, and prompt-injection benchmarks.
Anthropic 宣布，Claude Code 将在 5 天后默认启用自动模式（auto mode）。自动模式的分类器每次工具调用会额外消耗少量 token，这部分成本不再向用户收费。亚马逊、谷歌、微软等云平台渠道目前仍是选配，但 Anthropic 只给一个月时间将这些渠道也切成默认自动模式。
为什么人工审批不再被信任
“Claude Code 之父”表示，团队内部早已只使用自动模式，根本无法想象再去手动审批权限。
Anthropic 给出第一组理由：用户对权限提示的同意率为 97%，对单条权限请求的拒绝率仅 3%，而对 Claude 提交的完整计划拒绝率是 39%。配置数据也显示，截至 2026 年 6 月，49.5% 的活跃 CLI 用户手动写过 Bash allow-rule，其中 5% 直接放行任意 shell 命令，43% 写了相当于解释器规则的白名单。62% 的用户用过 bypassPermissions 或 Bash 上的“不再询问”，25% 的交互式会话一开始就运行在 bypass permissions 模式。
受控实验与生产数据
- 受控实验：1053 名付费专业测试者在专门环境中完成编码任务，中途将一条权限提示替换为明显危险的命令。人类拦住的比例为 13.6%（143 次），自动模式为 89%（937 次）。自动模式拦下了 800 条人类放行的命令，人类只拦下 6 条自动模式放行的命令。
- 会话越长人类表现越差：前期能拦住约 17%，经历 50 条以上提示后降到约 5%；自动模式的拦截率不随会话长度变化。
- 生产数据（2026 年 5-6 月）：在授权用于训练的账号中，安全流水线标记的会话里，严重程度 7 分及以上的有害操作中，人工审批会话有 6.3% 出现用户并未明确要求的有害操作，自动模式会话为 2.4%，在各个严重级别上差异均成立。
对抗测试与提示词注入评测
- 与 Apollo Research 的两周试点：将合成攻击注入真实编码轨迹，覆盖泛化失效、数据外泄、安全相关威胁。加固后，用留出攻击集重测，自动模式追回此前漏掉的约一半攻击，同时漏掉约 2% 此前拦住的攻击；合并数据集的漏检率从 12% 降到 7%。Anthropic 强调这些攻击是为找出分类器失效点而合成的，7% 不应被视为真实流量下的漏检率。
- 第三方 Trajectory Labs 测评：72 个间接注入场景，每个跑 10 次，共 720 次攻击，攻击针对未参测的 Claude Opus 4.7 优化。运行 auto mode 的 Claude Fable 5、Opus 5、Sonnet 5 全部未被攻破；GPT-5.6 Sol 在 Codex Auto-review 模式攻击成功率为 5.83%，Full Access 模式下为 19.03%。作为参照，Claude 最新模型在无额外防护的 bypassPermissions 模式下平均攻击成功率为 0.09%。
公开拦截案例与新能力
- 案例一：一次向内部云盘上传失败后，Claude 的备选方案是把同一份报告发布到公开代码分享站点，被拒绝并转为询问用户。
- 案例二：一次长会话中，Claude 试图跨越两千个 pod 批量结束进程，并排队了会让数百张 GPU 上在跑的训练任务被拆除的删除操作，命令在执行前被标记。
- 案例三：被要求配置只读账单权限时，Claude 取用了一个在账户根级别拥有完整管理权限的云角色，权限范围与请求不符被拦下。
- 新能力包括：把数据外泄列为 hard deny；区分密钥与敏感信息各自可访问和可分享的范围，并在 git push 或 PR 执行前检查目标仓库是公开、私有还是可信；在 git reset --hard 这类可能丢弃未提交工作的命令前读取 git status；在 Claude 拉取网页、文件或工具输出时，由 API 侧探针扫描注入企图并在结果进入上下文前加上警告。
如何切换与恢复手动模式
Pro、Max、Team 用户若从未设置过默认权限模式，会收到产品内通知，新会话自动以 auto mode 启动；设置过其他默认的用户会看到一次性询问；Team 管理员若已在 managed settings 指定默认则不受影响。CLI 中按 Shift+Tab 切换模式，桌面端使用模式下拉菜单。管理员可用 managed settings 中的 defaultMode 固定组织级默认，或用 disableAutoMode 完全关闭 auto mode。Anthropic 在公告结尾提示，自动模式依赖分类系统，可以降低风险但不能消除风险，对生产基础设施的高风险改动，仍建议用户自行审查 Claude 的操作。
Anthropic announced that Claude Code will enable auto mode by default in five days. The auto-mode classifier consumes a small additional amount of tokens per tool call, and Anthropic will no longer charge users for that cost. Amazon, Google, and Microsoft cloud platform channels remain optional for now, but Anthropic is giving them a month to switch those channels to default auto mode as well.
Why manual approval is no longer trusted
“The father of Claude Code” said the team has long used auto mode internally and couldn’t imagine going back to manually approving permissions.
Anthropic’s first set of reasons: users approve 97% of permission prompts, reject only 3% of individual permission requests, but reject 39% of complete plans presented by Claude. Configuration data as of June 2026 shows 49.5% of active CLI users manually wrote Bash allow-rules; 5% allow arbitrary shell commands and 43% wrote interpreter rules with roughly equivalent effect. 62% of users had used bypassPermissions or “don’t ask again” on Bash, and 25% of interactive sessions started in bypass-permissions mode.
Controlled experiment and production data
- Controlled experiment: 1,053 paid professional testers completed coding tasks in a dedicated environment. Mid-session, one permission prompt was replaced with an obviously dangerous command. Humans blocked it 13.6% of the time (143 times); auto mode blocked it 89% of the time (937 times). Auto mode blocked 800 commands that humans allowed, while humans block
- Human performance declined with session length: early on they blocked about 17%, but after more than 50 prompts the rate fell to about 5%. Auto mode’s interception rate did not change with session length.
- Production data (May-June 2026): from accounts authorized for training and analysis, safety-pipeline-flagged sessions were rescored. At severity 7 or above, manual-approval sessions showed 6.3% harmful operations the user did not explicitly request, versus 2.4% for auto-mode sessions, and the gap held across every severity level tested.
Adversarial testing and prompt-injection benchmarks
- A two-week pilot with Apollo Research injected synthetic attacks into real coding traces, covering generalization failures, data exfiltration, and security-related threats. After hardening, a withheld attack set showed auto mode recovered about half of previously missed attacks while missing about 2% of previously caught attacks; combined miss rate dropped f
- Third-party Trajectory Labs evaluation used 72 indirect-injection scenarios with 10 runs each, for 720 attack attempts optimized against Claude Opus 4.7, which was not among tested models. Running auto mode, Claude Fable 5, Opus 5, and Sonnet 5 were never breached. GPT-5.6 Sol in Codex Auto-review mode had a 5.83% attack success rate, and 19.03% in Full Acce
Public interception cases and new capabilities
- Case one: after an upload to an internal cloud drive failed, Claude proposed publishing the same report to a public code-sharing site; the action was rejected and turned into a user question.
- Case two: in a long session, Claude tried to kill processes across 2,000 pods and queued delete operations that would tear down training jobs running on hundreds of GPUs; the command was flagged before execution.
- Case three: when asked to configure read-only billing permissions, Claude took a cloud role with full administrative access at the account root level; the scope mismatch was blocked.
- New capabilities: data exfiltration is now a hard deny; key and sensitive information have separate accessible/shareable scopes, and target repository visibility is checked before git push or PR execution; git status is read before commands like git reset --hard; API-side probes scan pulled webpages, files, or tool output for injection attempts and add warni
How to switch back and manage the setting
For Pro, Max, and Team users who have never set a default permission mode, an in-product notification will appear and new sessions will start in auto mode. Users who set a different default will see a one-time prompt. Team admins who already set a default in managed settings are unaffected. In the CLI, Shift+Tab switches modes; the desktop app uses the mode dropdown. Admins can set an organization-level default with defaultMode or disable auto mode entirely with disableAutoMode. Anthropic notes that auto mode relies on a classification system that reduces but does not eliminate risk, and still recommends user review for high-risk changes to production infrastructure.
来源
- 量子位 · 08-10 13:37