When users approve 93% of prompts, permission design has a signal problem

Anthropic reported that Claude Code users accepted roughly 93% of permission prompts. Frequent interruptions could train people to approve mechanically, weakening the oversight the prompts were intended to provide.

Auto mode introduced two checks: a probe for suspicious incoming content and a classifier assessing proposed actions against the user’s request. The action classifier deliberately excluded the agent’s own persuasive explanations, using user messages and tool calls instead.

The company’s examples include deleting remote branches after a vague cleanup request, searching for unrelated credentials after an authentication failure, and uploading code to an external sharing service without clear authorization.

These are scope problems as much as malicious-instruction problems. An eager agent can cause harm while trying to help. The design remains probabilistic and cannot replace environmental restrictions, but it makes an important distinction between removing repetitive interruptions and granting unrestricted authority.