ClaimArticle
Auto mode is a better solution than asking humans to constantly approve actions, because confirmation fatigue makes human approval clearly unsafe.
The author buys the argument that auto mode beats constant human approval, citing confirmation fatigue as the reason humans clicking OK is not safe. ✦ AI generated
The article author · Simon Willison's Weblog · 2026-08-08 · original ↗
On the one hand, I absolutely buy that auto mode is a better solution than asking humans to constantly approve actions. Confirmation fatigue is real, and asking humans to click "OK" every few steps is clearly not going to result in safe behavior.
Read full article ↗excerpt · fair-use quotation
Around this claim
Evidence · 2
In a test across 1,053 paid testers where a permission prompt was swapped for a clearly dangerous command, only 13.6% of the humans refused the harmful action, whereas auto mode would have blocked 89% of those actions.The article author · Simon Willison's Weblog · conf 90%We've pretty much mitigated every attack in the main categories of risk we care about, such as prompt injection and data exfiltration, to the point that these risks are far lower than the average human reviewer.Cat Wu · Simon Willison's Weblog · conf 60%
This moment responds to
supports → In a third-party Trajectory Labs evaluation of 72 held-out indirect prompt injection scenarios across the latest Claude Code and Codex versions, none of the 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode.The article author · Simon Willison's Weblogrebuts → I'd like to see more independent confirmation of Anthropic's claims, because malicious instruction scenarios like a malicious package that exfiltrates data when it fetches model files may not be protectable by any version of auto mode.The article author · Simon Willison's Weblog