Anthropic’s quiet update makes human approval mandatory for AI actions, setting a new standard in AI governance.
The Auto mode architecture in Claude Code is genuinely worth studying. A two-stage ML classifier running on Claude Sonnet 4.6 sits in front of every tool call, evaluating whether the call should run before it executes. Anthropic shipped it on March 24, 2026, and the design choice that matters most is the one that doesn’t show up in any marketing: the classifier is reasoning-blind by design. It sees only user messages and tool calls, not Claude’s own text responses and not the content of tool results.
Then on July 3, 2026, v2.1.200 landed and quietly flipped the default from Auto back to Manual.
The v2.1.200 changelog
A one-line changelog entry, no blog post, no press release. The default permission mode moved from Auto to Manual across every surface where Claude Code runs: the CLI, the VS Code extension, the JetBrains plugin, and the built-in --help output.
Anthropic’s own anonymized telemetry reported that users approved roughly 93% of permission prompts. The pauses were happening. The reviewing was not. At a 93% approval rate, the human-in-the-loop is a ritual, not a control.
What Manual actually means
Out of the box, the agent halts before every file write, every shell command, and every network call. You can still turn Auto back on, but the choice is now explicit. The posture is the same as a strict CSP: default-deny with a narrow allow list.
The reasoning-blind classifier
The classifier reads two things: the user message that initiated the action, and the tool call the model is about to issue. It does not read Claude’s reasoning. It does not read the output of previous tool calls. It returns one of three verdicts: allow, deny, or escalate-to-human.
A prompt injection in a fetched web page lands in previous results and is structurally invisible to the gate.
Why v2.1.200 still moves the default to Manual
Anthropic can ship a great classifier and still choose to default to the mode that produces the highest genuine human attention. When the classifier misclassifies, the failure is contained to a model decision. When the human rubber-stamps a destructive command, the failure is on the developer’s machine, in the developer’s repo, possibly in production.
The default to Manual isn’t a step backward. It’s a baseline that admits the human wasn’t checking, paired with a classifier architecture that earns the right to be trusted with the next default flip.