Auto Mode Is Live: Claude Code Stops Asking Permission on Pro, Max, and Team
It shipped. As of today, new Claude Code sessions on Pro, Max, and Team plans start in auto mode unless a user or admin has pinned a different permission setting. The per-tool approval prompt is gone; in its place, a classifier evaluates each tool call against your request and your environment, blocking anything irreversible, destructive, or out of bounds before it runs.
The numbers Anthropic published to justify the change are the story. In a controlled study of 1,053 paid testers, auto mode blocked 89% of dangerous commands — while humans manually approving each prompt caught just 13.6%. Third-party red-teaming pushed the classifier’s miss rate from 12% down to 7%. Teams running auto mode also shipped roughly 25% more pull requests. Auto mode stays opt-in on Enterprise, the Claude API, Bedrock, Google Cloud’s Agent Platform, and Microsoft Foundry, giving admins room to review.
Anthropic Cancels the Sonnet 5 Price Hike — $2/$10 Is Now Permanent
Teams that spent the last month modeling a 50% increase in their Claude bill can put the spreadsheet away. Anthropic made Claude Sonnet 5’s introductory rate of $2 per million input tokens and $10 per million output permanent, canceling the scheduled move to $3/$15 that was set to take effect September 1.
The original plan had a hard deadline of August 31, and FinOps teams had been auditing workloads all month to decide what to migrate or throttle. That pressure is off. It also reprices the competitive math: Sonnet 5 stays the cheap workhorse for high-volume production traffic, with Opus 5 at $5/$25 reserved for the long-running agentic work that needs its 1M-token context.
Claude Tag Learns When to Stay Quiet — and Proactive Replies Are Free
Anthropic upgraded Claude Tag, the Claude-in-Slack teammate, to use context from across an entire channel plus its own memory and any standing instructions when deciding whether to jump into a thread. The result: Claude is roughly 30% better at judging when to contribute and, just as importantly, when not to.
Responses are faster and more accurate, and proactive replies are available now at no extra cost. In ambient mode, Claude can act without being tagged — flagging relevant updates from elsewhere in the org, following up on open threads, and keeping the team current. The new experience began replacing the older Slack integration on August 3 for Team and Enterprise customers.
Self-Hosted Claude Code Environments Hit Public Beta
Claude Code’s cloud sessions can now run on servers inside your own network. The self-hosted environments public beta, open to Team and Enterprise plans, moves execution onto infrastructure you provision — so repository checkouts, build artifacts, secrets, and any files a session touches stay on your machines. Sessions started from web, mobile, desktop, terminal, or a scheduled routine all run next to your internal services and toolchains.
Read the fine print before you get excited about air-gapping: every connection to Anthropic is still outbound HTTPS to api.anthropic.com for queue polling, the session event stream, and model inference. Prompts still leave your network. It’s off by default, incompatible with zero-data-retention, and Anthropic openly steers most enterprises to the hosted option — you’ll need a platform team to own the runner image and orchestrator.
Compliance API Now Covers Cowork and Claude Code, Plus Skill Security Scanning
The Compliance API has expanded past chat. Coverage now includes Cowork across desktop, web, and mobile, and Claude Code in both CLI and desktop — in beta for Claude Enterprise. Security teams can pull unified session content and metadata for audits and eDiscovery through the same interface they already use for Claude.ai conversations.
Landing alongside it: beta skill and plugin security scanning for Enterprise plans, which checks third-party uploads for malicious content before they run. That’s the natural counterweight to auto mode — if agents are going to execute with less human friction, the supply chain feeding them skills needs its own inspection layer.
MCP SDKs Cross a Billion Downloads as the Stateless Spec Rolls Out
The Model Context Protocol ecosystem just posted numbers that are hard to ignore. Tier 1 SDKs are pulling close to half a billion downloads a month, and both the TypeScript and Python SDKs have crossed one billion total downloads. That’s not early-adopter traffic anymore.
It arrives as the 2026-07-28 spec reshapes the protocol’s core from a stateful, always-open connection into stateless request/response. Practically: a remote MCP server that used to need sticky sessions and a shared session store can now sit behind a plain round-robin load balancer. The Tasks extension (contributed by AWS) covers long-running agents, and Enterprise-Managed Authorization is stable.
The $1 Claude for Government Deal Expires at Month’s End
A reminder for anyone in or adjacent to federal work: Anthropic’s limited-time program offering Claude for Government to federal agencies at $1 per agency with unlimited seats runs through August 2026. Two and a half weeks left on the clock.
The offering is FedRAMP High authorized and now includes Claude Code and Claude Cowork in public beta on Claude for Government Desktop, with tamper-evident audit logs, admin controls, and spend governance. Notably, Anthropic is the contracted and billing party — agencies don’t need a separate cloud-provider relationship to start.
Two Outages in a Week Put Reliability Back on the Agenda
Claude has had a bumpy August. On August 12, status.claude.com flagged elevated errors at 13:50 UTC, with four of six monitored services — claude.ai, the Claude API, Claude Code, and Cowork — showing degraded performance. It cleared by 18:07 UTC. That followed an August 5 incident where Opus 5 threw elevated errors across the same surfaces, resolved in under an hour.
Neither was catastrophic, but the pattern matters more as agents run unattended. Third-party monitors flagged the August 5 issue about 95 minutes before the official status page acknowledged it — a gap worth knowing about if your on-call runbook depends on Anthropic’s page as the trigger.
The 13.6% Number Is the Real Story
Everyone will focus on the 89%. The number that should actually reset how you think about agent safety is 13.6% — the share of dangerous commands humans caught while clicking through approval prompts. That is the honest measurement of what permission dialogs were buying you. Not much. After the fortieth prompt, approval stops being review and becomes reflex, and the ritual of consent was doing almost none of the work we credited it with.
Which reframes today’s other headlines. Anthropic isn’t removing a safety layer; it’s replacing a placebo with something measurable, then wrapping it in infrastructure — Compliance API coverage for Code and Cowork, skill scanning for third-party uploads, self-hosted runners for teams whose auditors need the execution on their own metal. Meanwhile, making Sonnet 5’s cheap rate permanent removes the cost objection to running agents at volume. Cheap tokens, autonomous execution, and an audit trail: that is a deliberate stack, aimed squarely at the enterprise buyer who wanted agents but needed a story for the risk committee. The open question is whether a classifier stays 89% effective once adversaries optimize against it — the red-team miss rate already moved from 12% to 7% under pressure, which cuts both ways.