Loading story…
Anthropic said Claude Code Auto Mode will become the default for Pro, Max, and Team users after testing showed people routinely approve risky coding-agent actions. Internal results cited by the company found users approve 97% of permission prompts, while a study with more than 1,000 participants found humans detected only 13.6% of dangerous commands overall and just 5% after 50 prompts; Anthropic said Auto Mode detected about 89% of those risky actions. The company said it has added hard denies for data exfiltration, protections for secrets and confidential data, checks on Git destinations and destructive Git operations, and API-side screening for prompt injection attempts.
Separate testing reinforced the same pattern: a browser-based simulation built by Belgian developer Alex Wauters recorded more than 40,000 game runs and 409,000 approval decisions, with players allowing roughly one in three malicious requests. Scope violations, typosquatted packages, and suspicious curl requests were among the prompts that frequently slipped through, especially under time pressure, highlighting approval fatigue as a core weakness in human review. Anthropic and outside researchers both said automated controls are not a complete fix, but argued that stronger permission models, sandboxing, cloud devcontainers, contextual hooks, and layered defenses are more reliable than depending on repeated human approvals alone.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
Alex Wauters launched a browser-based game in late May to test whether humans can safely approve or deny AI coding-agent permission requests, and published a concurrent blog post about it.
Anthropic launched Claude Code Auto Mode in March 2026 as a research preview before later broader rollout. The feature routes tool calls through a classifier to reduce reliance on constant manual approval prompts.
Anthropic introduced Auto Mode earlier in 2026 to let Claude Code decide when human intervention is needed using a separate classifier model.
Anthropic announced that Claude Code Auto Mode will become the default on August 14 for Pro, Max, and Team users, while remaining opt-in for Enterprise, API, and cloud-platform users for now.
Anthropic said third-party testing by Trajectory Labs found none of 720 prompt-injection attacks succeeded against Anthropic models running in Auto Mode.
In a two-week red-teaming pilot with Apollo Research, Anthropic said the classifier missed 12% of attacks before hardening and 7% afterward on a held-out test set.
Ahead of making Auto Mode the default, Anthropic added hard denies for data exfiltration, rules for secrets and confidential data, git destination and destructive-action checks, and an API-side prompt-injection screening probe.
Anthropic tested more than 1,000 participants and found humans caught 13.6% of dangerous commands overall, dropping to 5% after 50 prompts, while Claude Code in Auto Mode caught 89%.
After more than 40,000 game runs and about 409,000 approval decisions, Wauters found players approved roughly one in three malicious requests, with scope violations, typosquatted packages, and suspicious curl requests often missed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
infoworld.com
Open sourcetheregister.com
Open sourcehelpnetsecurity.com
Open sourcethenewstack.io
Open sourcetheregister.com
Open sourceclaude.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Research from Novee Security found that default AI agent harnesses from major vendors could be abused to exfiltrate secrets, bypass trust boundaries, and chain individually approved actions into harmful outcomes. Elad Meged reported multiple issues affecting Anthropic, Google, and OpenAI tooling, arguing that the root problem lies in architectural trust decisions, approval logic, and cross-stage handoffs rather than prompt injection alone. One Google Gemini CLI issue was tracked as **`GHSA-wpqr-6v78-jr5g`** with a **CVSS 10.0** rating, while weaknesses were also identified in Anthropic's Claude Code Action and OpenAI's Codex CLI sandbox. The findings showed how controls can fail when agent components such as tools, memory, prompts, and execution environments trust each other too broadly. Researchers said Google's agent could be pushed into a supply-chain-style attack that wrote to its own GitHub repository, illustrating how safe-looking steps can combine into exploitable workflows. Vendors have added mitigations and fixes, but the repeated pattern across products points to a broader industry problem for organizations deploying autonomous agents on untrusted input, especially where human review is limited or absent.
Jul 31, 2026
Anthropic introduced Claude Code mods, JavaScript or TypeScript functions that can intercept session events and change prompts, tool calls, permission handling, and the application interface. The feature is enabled by default in Claude Code version 2.1.287 and later, with mods distributed through the existing plugin mechanism. Mods expand a customization ecosystem that already includes project memory, workflow hooks, settings, and Model Context Protocol (MCP) tool connections. Mod code executes locally with access to the developer’s machine through Claude Code, making publisher trust and source-code review important security controls. Anthropic recommends inspecting mod source code and installing only mods from trusted publishers. For Team and Enterprise users, and machines with managed settings, Anthropic’s **sec-default** guard loads before user-installed mods and prevents them from overriding permission-deny rules by default. Outside those guarded environments, mods can override some permission decisions. Security teams should verify which guardrails apply before approving mods; the reported concern is an extension trust boundary, not a disclosed compromise or confirmed vulnerability.
Oct 2, 2026
Anthropic announced **Claude Code Security**, an embedded capability in *Claude Code* that scans customer codebases for vulnerabilities and suggests patches, initially rolling out to a limited set of enterprise/team customers for testing. The company said the feature was stress-tested via internal red-teaming, Capture-the-Flag exercises, and collaboration with **Pacific Northwest National Laboratory**, and positioned it as a way to reduce reliance on manual security reviews as AI-assisted “vibe coding” increases and attackers also use AI to accelerate weakness discovery. In parallel, Anthropic released **Claude Sonnet 4.6**, emphasizing improved coding performance, stronger “computer use” capabilities, and expanded developer tooling (e.g., adaptive/extended thinking modes, beta context compaction, and API tools for web search/fetch and code execution). Separate commentary highlighted the security risk of **agentic coding assistants** (e.g., *Claude Code*, *Cursor*, *GitHub Copilot*) operating with broad privileges—file access, shell execution, and secret handling—and argued that the emerging **Model Context Protocol (MCP)** ecosystem needs stronger, future-proof identity controls; additional industry guidance promoted **MLSecOps** as a way to integrate security into AI/ML development lifecycles, though it did not report a specific incident or vulnerability.
Jun 29, 2026