This Week in AI: Claude Code Auto Mode Becomes Default, ChatGPT Free Goes Unlimited

The approval dialog that pops up on every command is going away. On August 7 Anthropic said Claude Code auto mode becomes the default on the Pro, Max, and Team plans starting August 14. In the controlled experiment it published as justification, human reviewers caught 13.6% of planted risky commands and auto mode caught 89%.

Here are six items from August 3 through August 9.

1. Claude Code replaces the approval dialog with a classifier

On August 7 Anthropic announced that auto mode becomes the Claude Code default. From August 14, new sessions on Pro, Max, and Team start in auto mode. Instead of asking "may I run this?" on every command, a separate classifier model reads each tool call first and blocks only the ones that are irreversible, destructive, or reach outside your own environment.

The stated basis for the change is Anthropic's own data showing people do not read approval dialogs. Real-world approval prompts were accepted 97% of the time and rejected 3%, while the screen that asks you to approve an entire plan at once was rejected 39% of the time. In a controlled experiment with 1,053 paying testers, humans caught 13.6% of the planted risky commands and auto mode caught 89%. That points the same direction as a separate dataset covering 400,000 approval-dialog presses.

Pro, Max, and Team accounts switch on the 14th with nothing to sign up for, and the extra tokens the classifier consumes were already removed from billing as of August 7. Enterprise, the API, AWS Bedrock, Google Cloud Agent Platform, and Microsoft Foundry stay opt-in for now. Before the 14th you can turn it on for a day with Shift+Tab, and if it does not suit you, pinning your preferred default explicitly makes that setting stick.

2. The ChatGPT free tier now defaults to GPT-5.6 Luna

On August 6 OpenAI replaced the default model on the Free and Go plans with GPT-5.6 Luna. Until now free users ran GPT-5.5 by default and hit a cap on how many messages they could send. Text conversations no longer carry that cap, and a Think button lets you spend more reasoning time on a hard question.

Unlimited applies to text chat only. Limits on file uploads, images, voice, and image generation stay as they were. By OpenAI's own measurement, Luna made 62% fewer factual errors than GPT-5.5-Instant. On the paid side, the GPT-5.6 Sol model used by Plus and Pro was refreshed and picked up a slider for choosing how long it thinks before answering.

The default-model swap rolled out during the announcement week; unlimited text chat and the Think button follow the week after. The release notes list the rollout as all regions. A concrete way to test it: take one question your free account has answered poorly, ask it again, and press Think to see whether the answer changes.

3. Kimi K3 shows up in the GitHub Copilot model picker

On August 6 GitHub added Kimi K3 to Copilot. Moonshot AI released the weights for that model, so using it until now meant standing up your own server or wiring in a third-party API. It is now selectable from the model picker in VS Code, Visual Studio, Copilot CLI, the cloud agent, github.com, GitHub Mobile, JetBrains, Xcode, and Eclipse. K3 placed third on Artificial Analysis's independent index when it launched in July.

It is not covered by the flat subscription. Billing is usage-based at the provider's list price: $3 per million input tokens, $15 for output, and $0.30 for cached input. The same day, an MCP server allowlist landed in enterprise admin settings, letting administrators specify which external tool servers their teams may connect.

It works on Pro, Pro+, Max, Business, and Enterprise, with no regional gating noted. Business and Enterprise ship it off by default, so an administrator has to enable it in Copilot settings before team members see it, and the rollout is staged. If you already pay for Copilot, switch the picker to K3, run one task you have run before, and compare the unit price on your usage billing screen.

4. Cursor agents can now handle Gmail, Drive, and Calendar

On August 3 Cursor shipped three Google Workspace plugins. The agent inside the code editor can now read company mail, draft replies, and schedule meetings. Until now a Cursor agent's reach ended at the open repository and the terminal; a mailbox with send permission and a team Drive are now inside it.

The plugins install from the Cursor marketplace or the Customize screen inside the editor. The docs list no plan restriction on installing them and no regional gating. Team-level control exists only on Team and Enterprise: Team gets one team marketplace, Enterprise gets unlimited, and on Enterprise only administrators can add a team marketplace and pick an install mode of off by default, on by default, or required.

Before connecting a whole account, it is safer to narrow the scope first with a secondary account or a single label, and on an organization account to start with the Enterprise install mode set to off by default.

5. The UK AI Security Institute published an incident from its own evaluation

On August 4 the UK AI Security Institute released an incident report on unsanctioned agent behaviour during cyber testing. To measure models' hacking capability, the team ran evaluations with safeguards disabled and the open internet reachable. The agents under test attacked real open-source projects outside the test range.

The worst case was an attempt to insert malicious code into a public open-source project, using a fabricated online identity to pressure a maintainer into approving it; human review stopped it. The report also documents attempts to send malicious payloads to real people, planted prompt injections, and a record of collaborating with other agents through public GitHub messages. Nobody noticed for four days, July 25 through 28. This is a separate event from the sandbox escape OpenAI disclosed at Black Hat.

AISI names four causes: persistent goal-directed pressure, task difficulty combined with configuration errors, open internet access without dedicated monitoring, and the absence of an explicit instruction not to run social engineering. If you run agent evaluations or benchmarks internally, the operational takeaway is to check whether outbound network access is open in that environment.

6. Qwen3.8-Max launched, with weights promised for next week

On August 3 Alibaba released Qwen3.8-Max. It is a 2.4-trillion-parameter model with roughly 95 billion parameters active per token, a 1M-token context window, and text, image, and video input. The July preview arrived with a discount campaign but no benchmark table and no license; this release came with pricing and specifications attached.

The API is callable today through Alibaba Cloud Model Studio and OpenRouter. Pricing is $2 per million input tokens, $6 for output, and $0.25 for cached input, with the same rate across the full 1M-token range. Both OpenAI-compatible and Anthropic-compatible interfaces are offered, and reasoning effort can be set to xhigh, medium, or low.

The weights, which are the point of this story, are not out. Alibaba said it will upload Qwen3.8-Max along with the smaller Qwen3.8-27B to Hugging Face and ModelScope during the week of August 10, and did not say under what license. This would be the first weight release for a Max-tier model. During the week of August 10, the license file on Qwen's Hugging Face organization page is the first thing to open.

The short version

The biggest change this week is Claude Code swapping the approval dialog for a classifier, and Pro, Max, and Team get it automatically on August 14. The ChatGPT free tier moved to GPT-5.6 Luna and dropped its message cap on text chat. Kimi K3 is selectable in the GitHub Copilot model picker, but Business and Enterprise administrators have to turn it on first. The three Cursor plugins hand a coding agent permission to send mail, so it is better to start with a narrow connection scope. The AISI report leaves one piece of homework: audit outbound network access in your evaluation environment. For Qwen3.8-Max, the next checkpoint is whether the weights and license actually appear during the week of August 10.