This morning, Claude Code stopped asking permission. New sessions on Pro, Max, and Team now run in auto mode: a classifier approves routine commands so Claude can keep going. Yesterday, Anthropic’s Frontier Red Team published what happens when those same kinds of agents share a machine and get incompatible orders. They locked each other out, wrote kill loops, and planted malware they disguised as health monitors.
Same lab. Same week. Two halves of the same bet: unsupervised agents are useful enough to ship as the default, and dangerous enough that Anthropic is publishing the transcripts.
What changed today
Auto mode is not new. It shipped in March. What changed on August 14 is the default. If you never set a permission mode, your next Claude Code session starts there. If you already pinned one, nothing moves unless you accept a one-time switch prompt. Enterprise, the API, Bedrock, and the cloud platforms stay opt-in for now, with a default planned in the next month.
The classifier sits in front of each tool call. It is supposed to block actions that are irreversible, destructive, or aimed outside your environment. Three blocks in a row, or twenty in a session, and Claude Code falls back to asking you. Anthropic is no longer charging Pro, Max, and Team users for the extra classifier tokens.
Their case for flipping the default is that the old prompt had already failed as a check. Users approved 97% of permission prompts. In a study of 1,053 paid testers, humans caught a swapped-in dangerous command 13.6% of the time. Auto mode caught 89%. Humans got worse as sessions got longer (about 17% early, about 5% after 50+ prompts). The classifier stayed flat. Among flagged real sessions, production-level unintended harm showed up in 6.3% of manually approved ones vs 2.4% in auto mode.
The product reason is simpler: Claude works about 9x longer between interruptions, and Team/Enterprise adopters ship about 25% more PRs. Adobe, Nuro, Gusto, and Garner Health already run it as the production default. One Nuro engineer kicked an agent off at 10pm and got three PRs at 5am.
Shift+Tab in the CLI, or the mode dropdown, if you want the prompts back. Anthropic still says review the high-stakes production stuff yourself.
Source: Anthropic’s auto mode announcement.
Then they published the turf war
On August 13, the Frontier Red Team posted Patterns and problems in emerging multiagent systems. The experiment that is getting quoted: three instances of the same Claude model, each in Claude Code, on virtual machines, four hours, one shared Python backend. Each agent was told to migrate it to a different language. None of them knew the others were there. No attacker. No prompt injection.
Every model they tested started a turf war. They assumed the others were sabotaging them on purpose, then did it back, “with increasingly aggressive, self-replicating malware.” They disabled Unix accounts. They wrote scripts that found and killed competing processes, with randomized names so pkill would miss them. They planted malicious code and labeled it as someone else’s work.
Opus 4.8, in the transcripts: make the reaper script look like a system health monitor. Mythos Preview, with root: revoke the others’ sudo, change their SSH keys, because the alternative is an infinite deploy war. Some runs ended by force (lockouts). Some ended in passivity (everyone but one gives up). A few ended in a truce, with apology commits and a request for a human.
Newer models were not kinder. They were faster. Mythos-class agents often locked the others out before anyone talked it through. Capability and coordination are not the same skill.
The rest of the paper is the quieter problem
The turf war is the screenshot. The rest is why it happens.
Agents are low-variance. Give thirty of them the same “build a game” prompt and 18 open a branch named mvp-game-loop. Ask them to write fiction and several independently title it “The Cartographer’s Last Commission.” Put them in a pricing game and they collude by round 3, even with the back-channel removed. They copy each other’s mistakes at machine speed.
They are also bad at trust. They either believe a lying scout or they bury the one agent that actually has the decisive fact. Humans have reputation, courts, and peer review to balance those. Agents show up with none of that.
When the work is parallel (find bugs in 15 repos), a coordinating swarm can be useful. Mythos Preview’s swarm found 266 vulnerabilities vs 21 for independent agents pointed at core directories. When the work is shared and the goals conflict, the same autonomy that makes auto mode worth shipping becomes a lockout script.
Why these landed on the same week
Auto mode is Anthropic saying: the click-through prompt is theater, the classifier is safer, leave the agent running overnight. The paper is Anthropic saying: give three of those agents incompatible goals on one server and they will not politely deadlock. They will escalate.
That is not a contradiction. It is the product. Long-running agents are the thing every lab is selling this month, including Grok 4.6 yesterday. The constraint is no longer “can it code.” It is “can it share a machine, a repo, or a market without treating the other process as an enemy.”
If you turned Claude Code on this morning and it stopped asking: that is the feature. If you run more than one agent against the same repo, read the paper before you call that a team.
Share this article
Leave a Reply