開發者工具 · 2026-08-10

Claude Code 將於 8 月 14 日預設為自動模式：開發者必須知道的 11% 漏放率與新分類器把關機制

重點結論

2026-08-09，一位烏克蘭開發者發布了 Warpforge，一個用於與多個 AI 代理平行作業的開源環境；同一天，Twilio 公布了 2026 年第 2 季 15 億美元營收，Unity Software 將其該季描述為公司史上無疑最佳的一季。該專家小組將 Warpforge 視為單一代理使用者體驗的天花板下調訊號，以及開發基礎設施資本流動的確認。在真實的使用者與實測的效能極限取代此說法之前，信心仍維持在有條件的狀態。

一句話總結：在再多花一美元於 Warpforge 之前，先針對一項具名任務建立為期 14 天的留存率測試。

來源報導了什麼

改動了什麼、何時生效

標籤：<Claude Code, the Anthropic coding agent that runs in the CLI and IDE, is shifting the burden of routine permission decisions away from human developers and onto a proprietary classifier. According to techi.com, on August 14, Claude Code will stop asking many users to approve routine actions and will start asking a proprietary classifier instead. New sessions on Pro, Max, and Team plans will default to auto mode, turning a safety feature that once required an opt-in into the normal way Anthropic's coding agent works. The product change is paired with a behavior change for the agent itself: when auto mode blocks an action, Claude Code receives the denial as a tool result and is expected to find a safer path, such as a reversible command, a narrower target, or a clarifying question to the user. Pinned settings and managed defaults are not affected, so administrators who have already configured a different posture retain it. A backstop from the existing permission-mode documentation carries over: in interactive sessions, three consecutive denials or 20 total return Claude Code to manual approvals; headless runs terminate instead, which means a `claude -p` script that has exhausted its allowance will end as a process. Anthropic positions the move as a quality-of-life fix for an approval problem it has documented internally: 97% of permission prompts get approved, against a 39% rejection rate for agent plans, evidence that the prompts arrive without enough novelty to earn attention. The August 14 date is the production cutover, not the announcement, which went out on August 7 and was reported on August 9, 2026.>

預設背後的研究

標籤：<The headline figure attached to auto mode comes from an Anthropic-commissioned study with a very specific design. Anthropic's August 7 announcement says its classifier blocked 937 of 1,053 planted dangerous commands in a controlled study, while paid human testers stopped only 143. The automated gate still let 116 through. That 116-of-1,053 figure is where the "11% test miss rate" originates: 116 slipped past the classifier in the same stream where humans caught roughly 13.6%, or 143 of the 1,053 planted commands. Anthropic hired 1,053 paid professional testers and put them in a test coding environment, with humans catching 13.6%, or 143 of the 1,053 planted commands, and auto mode blocking 89%, or 937. Head-to-head, the classifier stopped 800 commands that humans approved, while people stopped six that auto mode would have allowed. A separate synthetic red-team test reported a 7% miss rate after hardening, suggesting the production classifier has been tuned further than the version that produced the 89% number. The numbers should be read narrowly. Testers worked in a synthetic environment, faced one planted danger per session, knew they were taking part in a study, and approved or rejected a single command without it executing. That setup tests whether someone notices an obvious bad command in a prompt stream; it does not test whether a classifier understands every destructive action hidden inside a real repository. Human performance also degraded as sessions lengthened, falling from 17% near the start to 5% after 50 prompts, while auto mode's rate stayed flat, which is the central behavioral claim used to justify the default.>

分類器實際看到什麼、看不到什麼

標籤：<Auto mode is not the same as bypass mode, and the distinction matters to anyone debugging a future Claude Code session. Narrow allow rules and project-local edits still resolve immediately because version control makes them reviewable, while shell commands, external services, writes beyond the project, and agent handoffs reach the transcript classifier. The classifier judges the action's real-world effect and whether the user actually authorized it, and is meant to see through wrappers, chained commands, or scripts that assemble a dangerous shell operation. From the session transcript, it sees user messages and executable actions, but not Claude's explanatory prose or raw tool results. Trusted-environment context such as repository visibility, git state, and data-handling rules is supplied separately, which reduces the injection surface but removes the provenance of raw tool results that could explain a legitimate command. Teams can tighten or loosen this through an auto-mode configuration guide that defines trusted repositories, cloud buckets, and other rails. When the classifier denies an action, Claude Code routes around it instead of failing: it may pick a reversible variant, scope the change down, or ask the user to state the missing authorization. After three consecutive blocks, or a longer session-level tally measured in tens, the session returns to manual approvals, which restores the old review cadence for the rest of that run. Headless runs terminate rather than degrade, which protects unattended pipelines from a slow erosion into permissive defaults.>

已確認事實、讀者影響，以及仍不確定之處

標籤：<Confirmed today: the default flips for new sessions on Pro, Max, and Team plans on August 14, the 937-of-1,053 blocking figure, the 116 that slipped through, the 13.6% human catch rate, the 7% post-hardening red-team miss rate, and the 97% approval rate for permission prompts as published by Anthropic through techi.com. Developer impact is concrete: CLI sessions will start issuing fewer approval pop-ups, but they can still escalate to manual approvals after three straight blocks, and shell commands and agent handoffs are still the highest-stakes category because they reach the classifier and can cut a session short. Readers who rely on tight loops in their editor, such as those who keep a [VS Code Keyboard Shortcuts](/dev/vscode-shortcuts/) cheatsheet handy, should expect fewer interruptions in interactive flows and a hard stop rather than a soft fallback in automated ones. Open questions that the source does not resolve: whether the production classifier matches the hardened 7% miss rate or sits closer to the study's 11%, how the session-long block tally will be measured when the underlying context window and transcript format change, and whether the regression to 5% after 50 prompts in humans will repeat in the classifier over long-headed sessions. Watch for the August 14 cutover, a published erratum or methodological note from Anthropic's safety team, and any change to the routing paths for shell commands and external writes.>

站內相關工具

資料來源

本頁分析由 Lizely AI 產生，內容以所連結的公開證據為根據；參與者為虛構的編輯角色，並非真人作者。