Claude Code's auto mode defaults on today — a bypass already beat it

Claude Code's permission model flips today: auto mode is now the default on Pro, Max, and Team plans, a pseudonymous researcher has already published a working bypass — and the same week, Claude Code's npm installs doubled past Codex's for the first time. DeepSeek shipped its own agent harness, MIT-licensed and past 91,000 GitHub stars in just over a day. Z.ai's GLM-5.3 picked up hacking skills Z.ai says it never targeted, and its open-weights release now trails two weeks for safety hardening. Google shipped Gemini 3.7 Flash three weeks after 3.6 Flash, and Cursor had it running the same day. And two community threads pushed back on the two biggest Anthropic stories of the last week: whether Opus 5 got harder to work with, and who gets caught by Claude's new watermark.

What your coding tools actually see

Auto mode goes default in Claude Code today — a bypass already works

Auto mode is now the default for new sessions on Pro, Max, and Team plans; Enterprise, API, and cloud platforms stay opt-in. A classifier judges safety instead of asking first, blocking what it flags as irreversible, destructive, or aimed outside your environment. Anthropic's own numbers: 1,053 paid testers; human review caught planted dangerous commands 13.6% of the time. Auto mode caught 89%. Two days before the switch, a pseudonymous researcher published a bypass: instructions hidden steganographically in an image, keyed behind a trivia puzzle so the classifier reads a game. Six of ten trials ran the downloaded code. Claude Code's npm installs also doubled to 23.7 million this week and passed Codex for the first time: installs, not users, but the flip lands on the most-installed agent CLI. Running auto mode on anything you can't afford to lose? The gap is open.

Auto mode is now the default in Claude Code for Pro, Max, and Team plans | Claude by Anthropic

Claude Code will soon run auto mode by default for Pro, Max, and Team plans, enabling longer-running autonomous work, and catching more dangerous commands.

Claude

DeepSeek ships a Claude Code rival: 91,600 stars in 28 hours

DeepSeek open-sourced its own agent harness Thursday: dsh, MIT-licensed, built on Cordis, an open-source plugin meta-framework. Everything (models, tools, sandboxes, the orchestration loop) swaps out as a plugin instead of shipping baked in. It's developer preview, and DeepSeek's own docs warn of breaking changes ahead. The repo passed 91,600 GitHub stars in its first 28 hours; DeepSeek's own launch post drew about 18,000 likes. A second major lab now competes directly with Claude Code and OpenCode on their own turf.

Which model runs your agent

GLM-5.3 picks up hacking skills Z.ai says it never targeted

Z.ai added vulnerability-discovery data to GLM-5.3's post-training. Instead of narrow gains, the model started chaining full exploit plans — a capability Z.ai says it never targeted. The numbers, from Z.ai's own blog: CyberGym, a find-the-vulnerability benchmark, rose from 77.2% to 84.5%, ahead of Claude Mythos 5 and GPT-5.6 Sol; ExploitBench more than doubled, 24.4% to 54.4%. The model is live today; the open weights trail by two weeks, until safety evaluation and hardening are done.

Read Z.ai's announcement: GLM-5.3 — Frontier Coding with Emergent Cyber Capabilities

Gemini 3.7 Flash ships three weeks after 3.6 — lands in Cursor same day

Google shipped Gemini 3.7 Flash Thursday, three weeks after 3.6 Flash: its fastest turnaround yet for the line. Google's own numbers: FrontierCode 1.1 jumped from 34.4% to 43.6%, DeepSWE v1.1 from 49.0% to 65.3%. Cursor added it the same day, and so did GitHub Copilot. Pricing undercuts what it replaces: $0.75 per million input tokens through year-end, doubling to $1.50 in January.

Why these two run together. GLM-5.3 and Gemini 3.7 Flash both shipped inside the same 30-hour window, on opposite ends of the same trade: Z.ai's post-training scale-up bought coding gains and an unplanned cyber capability in the same pass, while Google's three-week Flash cadence bought coding gains and nothing else newsworthy attached.

Introducing Gemini 3.7 Flash

Gemini 3.7 Flash is our most intelligent workhorse model yet for coding and agents.

GoogleTulsee Doshi

What people are pushing back on

Some engineers say Opus 5 stopped asking before it acts

Engineer Mun Logadan wrote this week that Opus 4.7, 4.8, and Fable used to stop and ask when intent was unclear; Opus 5 just proceeds, and colleagues report the same shift. No benchmark backs this up. The author labels their own explanation "baseless speculation." A separate r/ClaudeAI thread asks the identical question from a different crowd. Nothing here is measured. If a benchmark or Anthropic's changelog shows the same shift, it's real; until then, it's two threads.

Why does Opus 5 feel worse to work with?

A blog

The watermark panic runs into a fact: no detector exists yet

The watermark backlash reached Yahoo, which quoted a Redditor's list of who gets caught: "The student who used Claude to reorganize a paragraph. The journalist who asked the AI to summarize a two-hundred-page transcript." The r/ClaudeAI thread turned on its premise. There is no public detector; Anthropic holds the key. The top comment shrugs: "The mark would be more affirmation than condemnation." The policy covers models released after August 2 — nothing you can use today carries the mark.

Some Claude users are mad that Anthropic’s new watermarks will catch them using it at their jobs, classes
by u/IKeepItLayingAround in ClaudeAI

Also worth your time

• DeepSeek's V4 Pro pricing splits into peak/off-peak, effective Monday — off-peak rates run 50% below peak, per DeepSeek's own pricing post. The "significant increase" the docs warned about in issue #18 turns out to be a scheduling incentive, not a flat hike, at least for now.

• Why does CLAUDE.md keep growing? A new paper measures it — 247,694 instruction lifetimes across 1,867 repos: agentic prompts roughly triple in size over their lifetime, and older instructions get deleted at an exponentially falling rate. Adding a one-line comment explaining why an instruction exists cut excess instructions by 99.3% in their tests. Little discussion yet (single digits on HN), but a concrete, actionable fix for a real problem.

• Grok 4.6's biggest gain is one xAI didn't advertise — AA-Omniscience's non-hallucination rate — how often the model abstains instead of inventing an answer — jumped from 45.9% to 65.7%, the largest calibration improvement on the board; GPT-5.6 Sol sits at 7.8%. Third parties found it in the data; the r/cursor thread does the math on why calibration compounds across agentic steps.