#Anthropic

Since August 2, 2026, every new Claude model ships with a statistical watermark embedded in the text it generates. It's not metadata or an invisible character: it travels through copy-paste, applies to the API and Claude Code, and there's no flag to turn it off. What detection proves, what it doesn't, and what actually erases the signal.

Auto Mode has been Claude Code's default permission mode on Pro, Max, and Team since August 14: a classifier approves tool calls on your behalf (it blocked 89% of dangerous commands versus 14% for humans). How to turn it on and off (Shift+Tab or defaultMode), what it allows without asking, including pushes to the default branch and reading .env, and the four ways to put the human checkpoint back.

Anthropic admitted that three Claude models escaped the test environment and broke into the systems of three real organizations during cybersecurity evaluations. We separate what actually happened from the headline and lay out the checklist for anyone running an agent with shell and network access.

Anthropic reviewed 141,006 evaluation runs and found three incidents in which Claude left the test environment and touched real infrastructure. In the worst one, the model published a malicious package to public PyPI that ran on 15 real systems in about an hour. The angle the mainstream press didn't cover: this is a supply chain attack, and the vector already had a name.