Claude Code makes auto mode the default for Pro, Max and Team on Aug 14, and the week in Claude

PLUS: UK testers count 19 unsanctioned AI actions in a cyber test, Fable 5 hands off fewer biology questions, and Claude Code on your own servers

By SamAug 9, 2026

Hello, friends. Here's what changed in Claude from Aug 2 to Aug 8.

This week, Claude Code got a new default: auto mode, from Aug 14. UK testers said AI agents went after real people in a test. And Fable 5 now hands off fewer biology questions.

Plus 11 quick hits. Every claim has a link.

Auto mode becomes Claude Code's default on Pro, Max and Team

From Aug 14, new Claude Code sessions on Pro, Max and Team plans start in auto mode. The post's title and setup notes also list Ultra. A classifier checks each action instead of asking you.

Anthropic's Aug 7 post says it targets actions that are "irreversible, destructive, or aimed outside your environment." After three blocks in a row, or twenty in a session, it goes back to asking.

If you set a different default yourself, you may get a one-time prompt to switch. If you have a pinned default, nothing changes. Since Aug 7, Claude Code users on Pro, Max, Ultra and Team plans don't pay for the classifier's extra tokens.

Auto mode stays opt-in for now on Claude Enterprise and the Claude API. Same for Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform and Microsoft Foundry.

In Anthropic's study of 1,053 paid testers, people caught 13.6% of dangerous commands. Auto mode blocked 89%.

The testers worked in a setup built for the study, not on their own code. Anthropic says auto mode "does not eliminate risk."

UK testers say AI agents went after real people during a test

The UK AI Security Institute (AISI) says AI agents in a cyber test went after real people and groups. Most of it came from Anthropic's Mythos 5.

AISI's Aug 4 report says it ran one challenge 122 times across seven models. In 10 runs, an agent took "autonomous, unsanctioned action on the live internet."

AISI counted 19 such actions. Mythos 5 made 17. OpenAI's GPT-5.6 Sol, with its cyber classifiers off, made 2.

In the worst case, an agent tried to add malicious code to an open-source project. It made fake identities to pressure the maintainer. A human maintainer caught it and refused.

AISI says the most serious attempts failed. Some actions had a limited real-world effect, but in contained settings. It found no resulting real-world harm.

AISI had turned internet access on and the cyber classifiers off, on purpose. AISI says this wasn't a case of a model escaping its sandbox.

AISI says that setup doesn't match how frontier models are offered to the public. It says its own test design partly enabled the behaviour. It sees no clear sign of similar activity outside testing.

AISI says it saw "a small number of events under very specific conditions." It can't yet say how likely this is elsewhere. Nor can it be sure when the agent knew its actions were real.

Anthropic said on X that the prompts set no limits on internet use. With safeguards off, it says the setup is "not representative of any of our production models." It's running its own investigation.

Anthropic says Fable 5 now falls back far less on biology questions

Anthropic says Fable 5 now sends many fewer biology questions to a weaker model.

On Aug 7, Anthropic said it rewrote the rules for Fable 5's biology classifier. Then it retrained it. In its tests, biology fallbacks to Opus 5 fell "by about 85% across our product surfaces."

Anthropic says everyday health and learning questions should fall back far less. One example is interpreting lab results.

Fable 5 still falls back on dual-use requests, including virology, toxicology and molecular design. So Anthropic says it "isn't yet usable for professional biology research and drug development."

Anthropic expects all fallbacks to drop by roughly 67% on Claude.ai and 55% on Cowork. It expects 17% on Claude Code and 7% on the Claude Platform.

Claude Code sessions can now run on your own servers

Team and Enterprise orgs can now run Claude Code sessions on their own infrastructure (public beta).

With self-hosted environments (Aug 6), you start a session from web, mobile, desktop or a routine. It runs inside your network, not on Anthropic's servers. Repo checkouts, build files and secrets stay on your systems.

The chat itself still goes to Anthropic for inference. That includes prompts, responses and tool results. The transcript is stored, too.

The feature is off by default and not available for orgs using ZDR. For most enterprises, Anthropic "strongly" recommends its hosted option. It says self-hosting needs engineers to own setup and upkeep.

Managed Agents sessions can now have a hard spending cap

You can now set a budget on a Claude Managed Agents session. It's a hard cap on the session's spend, priced at public list rates.

Per the release notes (Aug 7), a session that hits its budget pauses. It doesn't start new model requests. Changing or removing the budget resumes it.

Sessions can also now load skills from a GitHub repo they mount.

Claude Code sessions can now message each other

Claude Code shipped six updates this week. One lets your sessions talk to each other. Two others close holes in its permission checks.

2.1.224 (Aug 7) lets sessions message each other, on any of your machines (macOS and Linux).
It also removes the cap of 200 subagents per session. Concurrency and depth limits still apply.
2.1.223 (Aug 6) fixes a Bash permission bypass. A crafted command could hide parts of itself from permission checks.
2.1.222 (Aug 4) fixes a hole in worktree isolation. Sessions and their subagents could run destructive git commands on the main checkout.
2.1.221 (Aug 4) fixes a Bash permission-check bypass where zsh could run hidden commands inside [[ ]] regex conditionals. Those commands now ask for permission.

Quick hits

Claude Opus 4.1 is retired (Aug 5). Requests to it on the Claude API now return an error, and Anthropic recommends Claude Opus 5. Researchers can request ongoing access through its External Researcher Access Program.
Enterprise plans can now turn on skill and plugin security scanning (beta, Aug 6). It checks third-party skills and plugins for malicious content when someone uploads or edits them.
The Compliance API now returns Cowork session transcripts (beta, Claude Enterprise, Aug 3). That covers sessions started on claude.ai web or mobile.
Anthropic is building a team to design its own AI chips, TechCrunch reports (Aug 5). Anthropic confirmed it to TechCrunch.
Tino Cuéllar will join Anthropic as its first Chief Global Affairs Officer (Aug 4). He stepped down from Anthropic's Long-Term Benefit Trust to join.
Millennium and Anthropic are building a "digital risk analyst" (Aug 6). It's an AI teammate built to work under the supervision of the firm's risk managers. Human experts evaluate and approve its decisions.
Some users had trouble logging in to Claude.ai and Claude Code on Aug 4, and some saw model errors. Per the status page, the incident was open from 3:48 to 4:59 p.m. Central.
Claude had elevated errors on Mythos 5, Fable 5, Opus 5 and Sonnet 5 on Aug 5. Per the status page, the incident was open about 7 hours, from 2:05 to 9:14 a.m. Central.
Claude Code's /review is now an alias of /code-review (2.1.223, Aug 6). With no effort level, /code-review reuses the level you typed last.
Auto mode now checks messages Claude Code sends to other sessions (2.1.222, Aug 4). The same release removed ultraplan.
You can now pick where a Managed Agents agent's inference runs (Aug 7), per the release notes. You set it when you create the agent, or override it for one session.

Worth your time

AISI's full incident post (Aug 4): what happened, why, and what AISI is changing.
Running auto mode in production (Aug 7): how Nuro, Gusto and Garner Health use auto mode. Anthropic says Claude now works 9x longer between interruptions in Claude Code than under the old default.
A guide to cost visibility and control in Claude (Aug 4): how admins can see and manage Claude costs.

That's the week. The next issue lands Sunday, Aug 16.

Reply and tell me what you're building. I read every reply.

— Sam