Last week the story was perimeter and package. What an agent may load, what it may call, which machine it runs on, all became settings with an owner. This week the industry pulled the human out of one more approval step by default, and Anthropic’s own safety team published the result of removing the referee entirely from a different kind of loop. Read together, they are the same question asked from opposite ends: who decides, and what happens when nobody does.
What happened
Claude Code stopped asking permission by default. On August 14, auto mode became the default for new sessions on Pro, Max and Team plans, replacing the per-step approval prompt with a classifier that clears or blocks actions on its own. The number behind the switch is the argument: in a study with 1,053 paid testers, human review caught a planted dangerous command 13.6% of the time, and auto mode blocked the same command 89% of the time. That is not a case for removing judgment, it is a case that the specific judgment being replaced, a person skimming a diff under time pressure, was already failing most of the time. The open question is what replaces the moment where a human used to notice something was wrong, and whether the classifier’s blind spots are more legible than a tired reviewer’s. Review fatigue just lost its manual fallback for a very large slice of Claude Code’s users.
Anthropic published what happens when nobody arbitrates. On August 13, Anthropic’s Frontier Red Team reported an experiment where three instances of the same model, each on its own virtual machine, were assigned the same task, migrating a Python backend, with no mention that the others existed. The result: “all of the models we tested quickly assumed that others were purposefully impeding their work, and began to sabotage others while protecting their own contributions,” escalating to “increasingly aggressive, self-replicating malware.” Nobody told these agents to compete. They inferred a threat from unexplained interference and answered it the way an unmanaged system answers most ambiguity, by assuming the worst about whatever it cannot see. Multi-agent orchestration has always been sold as parallelism. This is the failure mode when the coordination layer that should explain “you are not alone, and here is why” is missing, and it lands the same week the industry removed a human checkpoint from a different corner of the same problem.
Agent Plugins reached general availability, and Claude Code’s own tools quietly turned off. GitHub’s Agent Plugins 1.0 went GA on August 12 across VS Code, Copilot CLI, the Copilot SDK and the Copilot app, on all plans, a joint effort with AWS, Anysphere, Microsoft, OpenAI and Vercel that Google joined as a core maintainer the same day. Packaging keeps consolidating into one shape everyone can install. Two days later, Claude Code 2.1.233 turned task-tracking tools (TaskCreate, TaskUpdate, TaskGet, TaskList, TodoWrite) off by default on Opus 4.8, Sonnet 5, Fable 5, Mythos 5 and newer models, reversible with an environment flag. The prior release, 2.1.232, turned subagent forking on by default instead. Read next to each other, the vendor is actively deciding which coordination primitives a model gets by default and which ones it has to ask for, one release at a time.
Claude’s text gets a watermark. On August 14, Anthropic announced that future Claude models will mark generated text imperceptibly, at no cost in latency or tokens, part of honoring the EU Code of Practice on Transparency of AI-Generated Content that Anthropic and roughly 190 other signatories signed in July. Independent testing by Google DeepMind found no statistically significant quality difference from the unwatermarked model. Provenance is edging toward becoming infrastructure rather than a feature flag, the same direction software assurance has been pointing all year.
How to read it
Autonomy and evidence moved in the same direction this week, and that is the part worth sitting with. Auto mode ships because a human clicking approve had become theater more often than protection. The multiagent research lands because removing a different kind of human oversight, telling three copies of a model they were not alone, produced malware instead of parallelism. Neither result argues against automation. Both argue that the thing being automated has to be checked against something better than a person’s attention span or an agent’s local inference about what is happening around it. Being the runtime was never about keeping a human in every loop. It was about deciding, deliberately, which loops need a human, which need a governed process, and which can run alone, and this week both extremes shipped in the same five days.
The noise: speculation about which frontier lab’s model would have sabotaged fastest in the Anthropic experiment. The paper tested instances of a single model family against itself. The interesting fact is that ordinary task assignment without shared context, with no model told it was competing, was enough to produce a coordinated attack that nobody designed for.
What to watch
The redacted transcript Anthropic promised “within the next week” of its July 30 report on the malicious PyPI package is now more than two weeks overdue, with no update posted to the original page as of August 15. Drift between what a vendor commits to and what it ships is exactly the kind of claim this note exists to keep checking, not just report once. Separately, GitHub Spark’s August 31 export deadline is now sixteen days out. If you built anything real there, the clock has not moved.