Anthropic announced that, starting August 14, Claude Code will stop asking users to click “approve” for every tool call. Instead, an AI-driven risk classifier will decide which actions need human review. A study of 1,053 testers showed 97 % of clicks happened without reading the prompt, and the classifier caught 89 % of harmful actions while humans caught only 13.6 %.

Why the old “click to approve” model fell short

The old workflow forced a human to confirm each external action—pushing code, deleting files—by clicking a button. In practice, users treated the dialog as a formality and approved reflexively. The study’s numbers expose the problem: almost every click was a reflex, and the few genuine warnings that got attention missed most risky operations. When a safety gate disappears, system security erodes.

What the new classifier does

Anthropic’s replacement is a trained model that evaluates each pending action and interrupts only when the operation falls into one of three categories:

  • Irreversible – actions that cannot be undone, like force-pushing to a repository or dropping a database table.
  • Destructive – bulk deletions or overwriting files that could erase work.
  • Outward-facing – steps that expose code or messages to external systems, such as opening a pull request or sending a Slack notification.

If an action does not meet any of these criteria, the model lets it proceed automatically, ending the flood of prompts that users ignored.

Limits of an AI-only approach

The classifier is not a universal safeguard. It learned general notions of harm, not the specifics of any codebase. A folder named “tmp” might be harmless in most projects but could contain critical build artifacts in yours; the model would likely deem it safe. The study’s performance does not guarantee identical results in every production environment. Edge cases—especially those involving custom tooling or sensitive infrastructure—still need explicit permission settings or extra monitoring.

What users need to do now

  • Review the new permission mode: Pro, Max, and Team plans will automatically adopt the classifier. If you rely on a custom permission workflow, verify that it still aligns with your security policies.
  • Identify high-risk actions: Map your CI/CD pipelines and deployment scripts to the three trigger categories. Adjust scripts that perform irreversible or destructive steps to include explicit safeguards if the default classifier is insufficient.
  • Monitor classifier alerts: Track the frequency and accuracy of interruptions. Early feedback will help Anthropic fine-tune the model and may prompt you to re-enable manual confirmations for particular workflows.

What to watch next

Switching from human reflex clicks to a trained model is a clear attempt to close a safety gap that existed in many CI pipelines.

Source: https://dev.to/code_with_kyryl/97-of-your-ai-approval-clicks-were-reflexes-18lg