Auto mode becomes the default permission mode
Since August 14, auto mode is the default permission mode for new sessions on the Pro, Max, and Team plans. Instead of interrupting at every action, a classifier in the background lets safe actions through and stops risky ones. If you set a default mode yourself, it stays in force until you accept a one-time offer to switch, and a mode an organization mandates does not change automatically. One detail matters for your quota: the classifier calls auto mode makes do not count against usage limits, except on Enterprise plans and on accounts running through the Claude API, Bedrock, Google Cloud's agent platform or Foundry, where they consume tokens.
Source
Choose a permission modeClaude Code official documentation · Original published August 14, 2026
Auto mode has been the default for new sessions on the Pro, Max, and Team plans since August 14.
How it works
A classifier runs in the background and decides action by action: the safe ones pass, the risky ones stop and wait for you. In practice that means reading files and searching pass, while deleting and sending anything off the machine still ask for your confirmation.
What if you already set the mode yourself
Your choice stays in force until you accept a one-time offer to switch. A mode an organization mandates does not change automatically.
The detail that affects your quota
The classifier calls auto mode makes do not count against usage limits. The documentation names an exception: on Enterprise plans and on accounts running through the Claude API, Bedrock, Google Cloud's agent platform or Foundry, those calls consume tokens, so on those accounts auto mode is not free.
Sources
Corrections
An earlier version said the classifier calls auto mode makes do not count against usage limits, and that auto mode therefore adds no cost. After checking the primary source the text has been corrected: the documentation names an exception for Enterprise plans and for accounts running through the Claude API, Bedrock, Google Cloud's agent platform or Foundry, where those calls consume tokens.
Related
OpenClaw 2026.10.2 stops long tool output from slipping credentials past redaction
A bug in OpenClaw's secret masking let a credential through whenever it straddled the boundary between two slices of a long text. The fix ships in 2026.10.2 along with repaired updates from 2026.10.1 and a new compaction default for OpenAI and Anthropic API keys.
OpenClawverified
OpenClaw 2026.10.1 lets agents search installed skills and changes how sessions message each other
OpenClaw released version 2026.10.1 on October 10, 2026, its first stable release since 2026.9.7. Agents can now search the skills installed on a machine and read only the one a task needs, instead of carrying the whole library in the prompt. Opt-in MCP Apps run beside chat, and full backups can go to an external drive or Cloudflare R2. Three changes can break existing setups: session-to-session messaging, the old required argument, and Workboard data stored before July 2026.
OpenClawverified
Claude Code 2.1.294 fixes prompt hooks that let through the actions they were written to block
Anthropic released Claude Code 2.1.294 on October 8, 2026. It fixes prompt and agent hooks phrased as instructions, which could allow exactly the actions they were meant to stop. Version 2.1.295 followed the same day with an onFailure setting that makes a crashed or timed-out command or HTTP hook block the action. Releases 2.1.292 and 2.1.293 from earlier in the week closed several permission and sandbox gaps.
Claude Code Releases (GitHub)verified