Anthropic makes Claude Code's autonomous permission mode the default on paid plans

Anthropic will make auto mode — a classifier that approves or blocks Claude Code’s tool calls without asking — the default for Pro, Max and Team plans from 14 August, publishing test figures showing humans caught 13.6% of dangerous commands against the classifier’s 89%. Elsewhere Amazon’s planned Pecos County data center is permitted to emit 33 million tons of CO2 a year from its own gas plant, which would make it the largest single source of climate pollution in the United States, and OpenAI absorbed presentation startup NextSlide on undisclosed terms. A quiet Sunday: the feeds carried no new research papers and no model releases.

Developer Tools #

Auto Mode Is Now the Default in Claude Code for Pro, Max, and Team Plans #

Anthropic / Simon Willison

From 14 August, new Claude Code sessions on Pro, Max and Team plans start in auto mode, where a classifier evaluates each tool call against safety rules and permits, blocks, or escalates it, instead of the per-action permission prompt. Anthropic published the numbers behind the decision: users approve 97% of manual permission prompts, and in a controlled test with 1,053 participants auto mode blocked 89% of dangerous commands against 13.6% caught by humans reading the same prompts. Classifier overhead tokens are no longer billed on those three plans; Enterprise, the Claude API, Bedrock, Google Cloud’s Agent Platform and Microsoft Foundry stay opt-in, and users can switch back with Shift+Tab or pin a setting. The claim that auto-mode users ship roughly 25% more PRs is a comparison between self-selected groups rather than a controlled result, and should be read as such. Simon Willison’s reading is the useful counterweight: he accepts that confirmation fatigue makes the human prompt close to worthless, wants independent confirmation of the 89%, and points out that the residual 11% is now the security boundary — in particular for third-party packages carrying hidden instructions, where the right defence is not giving the agent access to data worth exfiltrating in the first place.

Infrastructure #

Planned Amazon Data Center Could Become the Biggest Climate Polluter in the U.S. #

New York Times / TechCrunch

Amazon’s planned data center in Pecos County, Texas will run on an on-site natural gas plant permitted to release 33 million tons of CO2 a year — more than any existing power plant in the United States. Amazon says the site “will be powered by new on-site generation that won’t raise electricity costs for Texas families,” and a spokesperson added that “the world looks different now than when we co-founded the climate pledge” while maintaining the 2040 net-zero commitment; the company’s emissions rose 16% last year. Behind-the-meter gas generation is the current answer to grid interconnection queues that run years long, which means the permitting record, not the sustainability report, is where the real capacity plans of the hyperscalers now show up first.

Funding & Business #

OpenAI Acquires Presentation Startup NextSlide #

TechCrunch

OpenAI has acquired NextSlide, a startup building prompt-to-deck generation that turned notes, documents and research into editable presentations; founder Ahmed Beshry says the team is now working on ChatGPT. Terms, headcount and the deal date were not disclosed — the acquisition reportedly closed earlier in 2026 and surfaced only now — so there is no valuation signal here, only a direction. Beshry previously co-founded Caper AI, sold to Instacart in 2021.

Threads to Watch #

The human approval step has now been measured, and it did not survive the measurement. Anthropic’s own figures say the permission prompt caught 13.6% of dangerous commands and was clicked through 97% of the time — a control that exists mostly to distribute blame. Replacing it with a classifier is defensible on those numbers, and it also relocates the trust boundary: what used to be a person’s attention is now an 11% miss rate in a model that the untrusted input is talking to directly. Willison’s response points at the only structural answer, which is scoping what the agent can reach rather than improving what approves it. Expect the interesting failures to be the ones where the classifier is right about the command and wrong about the context.

Agent throughput is starting to show up in permitting files. The productivity claim on one side of today’s digest is 25% more pull requests; the infrastructure claim on the other is a single site permitted for 33 million tons of CO2 a year, built with its own gas plant because the grid cannot connect it fast enough. These are the two ends of the same demand curve, and they are measured by entirely different institutions on entirely different timescales — quarterly developer metrics against multi-decade air permits. The second is the harder number to revise once issued.