Anthropic Measures AI Agent Autonomy in Practice – Key Findings and Implications

TL;DR

Anthropic’s February 2026 research shows that Claude Code agents now run autonomously for up to 45 minutes per turn, experienced users both auto‑approve more actions and interrupt more often, the model asks for clarification twice as often as humans interrupt on complex tasks, and while most API‑based agent actions are low‑risk, emerging usage in healthcare, finance, and cybersecurity signals a growing frontier of risk.

Measuring Autonomy with Two Data Sources

Anthropic combined (1) Claude Code session logs, which link requests across an entire workflow, and (2) public API tool‑call records, which provide breadth across thousands of customers. Both streams were processed with Anthropic’s privacy‑preserving infrastructure Clio, enabling analysis of millions of interactions while preserving user confidentiality.

Claude Code offers deep insight into turn‑by‑turn autonomy, interruptions, and clarification behavior because each session is fully observable.

Public API offers a wide view of agentic deployments across domains but only at the granularity of individual tool calls, limiting the ability to reconstruct multi‑step workflows.

Claude Code Autonomy Is Growing

Turn duration has nearly doubled for the longest 0.1 % of sessions, rising from under 25 minutes (Oct 2025) to over 45 minutes (Jan 2026). Median turn length remains stable at ~45 seconds.
The increase is smooth across model releases, indicating that factors beyond raw capability—such as user trust, task ambition, and product improvements—drive longer autonomous runs.
Internal Anthropic usage mirrors this trend: success rates on the hardest tasks doubled while average human interventions fell from 5.4 to 3.3 per session.

“The autonomy models are capable of handling exceeds what they exercise in practice.” – Anthropic research team

Experienced Users Shift Oversight Strategies

Auto‑approve rate rises with tenure: new users (< 50 sessions) auto‑approve ~20 % of sessions; users with ~750 sessions auto‑approve > 40 %.
Interrupt rate also rises: users with ~10 sessions interrupt ~5 % of turns, while seasoned users interrupt ~9 % of turns.
The dual increase reflects a transition from per‑action approval to monitor‑and‑intervene oversight: experienced users let the agent run freely but step in when needed.
On the public API, human involvement drops from 87 % on low‑complexity tool calls to 67 % on high‑complexity calls, suggesting that step‑by‑step approval becomes impractical for larger workflows.

Agents Self‑Regulate via Clarification

Claude Code asks for clarification more than twice as often on the most complex tasks compared to minimal‑complexity tasks.
Clarification requests outpace human‑initiated interruptions, indicating that the model actively limits its own autonomy when uncertain.
Table 1 (in the original post) shows the most common reasons for model‑initiated stops (e.g., presenting alternative approaches 35 %) and human interruptions (e.g., providing missing technical context 32 %).

Risk Landscape of Public‑API Agents

Anthropic scored each tool call on a 1‑10 risk scale and a 1‑10 autonomy scale. 80 % of calls have at least one safeguard, 73 % involve a human in the loop, and only 0.8 % are irreversible.
High‑risk clusters (e.g., API‑key exfiltration, patient record retrieval) are rare but present, often linked to security evaluations rather than production use.
High‑autonomy clusters include automated system health monitoring and cryptocurrency trading bots, with autonomy scores up to 8.3.
Domain distribution: software engineering accounts for ~50 % of tool calls; other domains (business intelligence, finance, e‑commerce, etc.) each contribute a few percent.

Limitations of the Study

Data are limited to Anthropic‑hosted models; patterns may differ for other providers.
Public‑API analysis cannot reconstruct multi‑step sessions, potentially over‑representing high‑frequency workflows.
All classifications (risk, autonomy, interruption reasons) are generated by Claude itself, with limited manual validation due to privacy constraints.
The snapshot covers late 2025 – early 2026; rapid capability and adoption changes may shift trends.
Some high‑risk actions likely represent simulated evaluations rather than live production impacts.

Recommendations for Stakeholders

Model & Product Developers

Invest in post‑deployment monitoring that links discrete tool calls into coherent sessions while preserving privacy.
Train models to recognize uncertainty and surface clarification requests; Claude’s behavior shows this reduces unmonitored autonomy.
Design interfaces for active monitoring (real‑time steering, OpenTelemetry) rather than mandating per‑action approval.

Policymakers

Avoid prescriptive rules that require human approval of every action; the data show experienced users prefer monitoring and selective intervention.
Encourage industry‑wide standards for privacy‑preserving telemetry that can capture session‑level autonomy metrics.

Core Insight

The autonomy agents exhibit in the wild is a co‑construction of model behavior, user trust, and product design. Claude Code agents already possess the capacity for far greater autonomy than they are granted, users gradually shift from granular approval to strategic oversight, and the model itself self‑regulates by asking for clarification. Effective safety frameworks must therefore combine real‑world monitoring, uncertainty‑aware models, and tooling that empowers users to intervene when needed.

Authors: Miles McCain, Thomas Millar, Saffron Huang, Jake Eaton, Kunal Handa, Michael Stern, Alex Tamkin, Matt Kearney, Esin Durmus, Judy Shen, Jerry Hong, Brian Calvert, Jun Shern Chan, Francesco Mosconi, David Saunders, Tyler Neylon, Gabriel Nicholas, Sarah Pollack, Jack Clark, Deep Ganguli.