Claude dangerously-skip-permissions, Safely

Claude Code --dangerously-skip-permissions turns off the permission prompts for a whole session, which is why people call it YOLO mode. The flag doesn’t make the agent any less able to do damage; it removes the moment where you would have noticed. Run it only where something outside Claude Code still enforces policy on what the session can reach.

At Formal we use Claude Code heavily, and we’ve written before that approving every edit and every command eats time. The obvious fix, allowlisting a few build and test commands, often amounts to allowlisting all of them, because tools like go test, make and eslint run whatever code the agent just wrote. So the real question about Claude Code permissions isn’t how many prompts to keep. It’s where the controls live once the prompts are gone.

What does Claude Code `--dangerously-skip-permissions` do?

The flag starts the session in bypassPermissions, which the interface labels bypass permissions. Anthropic’s permission modes documentation says the mode “disables permission prompts and safety checks”, so shell commands, file edits, MCP tool calls and network requests run without asking, including writes to protected paths. Launching with claude --permission-mode bypassPermissions is equivalent.

That isn’t a blank check, though. A few controls survive it:

Deny rules keep blocking in every mode, this one included. Allow rules, on the other hand, have no effect.
A few actions prompt anyway, such as recognized rm and rmdir removals of critical paths. You can turn off the prompt for dangerous rm commands in this mode, so don’t treat it as a safety net.
Root is refused. On Linux and macOS, it won’t start this way as root or under sudo, unless it detects a recognized sandbox.
Admins can switch it off for a whole organization through managed settings, shown in the next section.

What it doesn’t give you is any defense against prompt injection. Anthropic’s docs say it “offers no protection against prompt injection or unintended actions”, and they warn to use it only in isolated environments such as containers, VMs or dev containers that have no internet access. That last condition is the one most real setups can’t meet, and it’s where this post spends most of its time.

How do you enable dangerously-skip-permissions, and how do admins turn it off?

From the terminal, pass the flag or the equivalent mode when you launch the CLI. For fully unattended runs, Anthropic’s own setup table pairs the flag with print mode, and lists a container, a VM or the sandbox runtime as required, running as a non-root user on Linux and macOS:

claude --dangerously-skip-permissions
claude --permission-mode bypassPermissions
claude -p "<prompt>" --dangerously-skip-permissions

Commands from the Claude Code permission modes docs.

You can’t switch into bypass mode partway through a session that started without it. The --allow-dangerously-skip-permissions flag adds the mode to the Shift+Tab cycle without turning it on, and permissions.defaultMode: "bypassPermissions" in your user or managed settings starts every session in it. In the VS Code extension, the option only appears after you turn on the “Allow dangerously skip permissions” toggle in the extension settings.

Two places can’t start it. A project’s checked-in .claude/settings.json or .claude/settings.local.json can’t make bypass the default: the session starts in Manual mode instead. Cloud sessions also ignore defaultMode: "bypassPermissions" from settings files, so a repository can’t turn it on for a cloud session by itself.

To take it away from everyone, an administrator sets this key in managed settings:

{
  "permissions": {
    "disableBypassPermissionsMode": "disable"
  }
}

That’s the right default for laptops that hold production credentials. The rest of this post is about the machines where you do want prompts off, and what has to be true around them.

Auto mode vs YOLO mode vs the sandbox: which one fits?

Claude Code offers three ways to cut prompts, and they trade off differently. Auto mode has a classifier model review each action in your place; from Claude Code v2.1.283 it’s the built-in starting mode for interactive terminal and VS Code sessions. The Bash sandbox, set to auto-allow, runs sandboxed commands without prompting. Bypass removes review entirely. As of November 2026, Anthropic’s docs describe them like this:

	Auto mode	`bypassPermissions` (YOLO mode)	Bash sandbox, auto-allow	Bypass in a VM behind Formal Endpoint
Who reviews each action	A classifier model	Nobody: tool calls run immediately	Nobody, for sandboxed commands	Nobody in Claude Code; Formal policies evaluate intercepted requests
Deny rules	Apply	Apply	Apply	Apply, plus Rego policies on the network path
Network	The classifier blocks actions that target unrecognized infrastructure	No restriction from Claude Code	Allowed domains through a local proxy that doesn’t inspect TLS by default	TLS terminated on the flows your network rules select
Credentials	Whatever the session can read	Whatever the session can read	Most of the machine is readable, including `~/.ssh`, unless you list it	Placeholder in the session; a Connector injects the real key
Anthropic’s guidance	Reduces prompts, “does not guarantee safety”	Isolated containers and VMs only	Local iteration with fewer prompts	Not an Anthropic mode: Formal’s setup

On a laptop, try auto mode or the sandbox before you skip prompts entirely. Auto mode keeps a reviewer in the loop, even if it’s a model, and the sandbox narrows what shell commands can touch and which domains they can reach. Turning review off makes sense once the boundary sits outside the agent: sandbox the machine first, then skip prompts.

What can go wrong in Claude Code YOLO mode?

Most of the risk isn’t that Claude Code does something strange. It’s that nothing stands between a strange action and the systems it touches.

Secrets are in reach. Without a sandbox, a session with prompts off reads every file your user account can, including .env files in the project and the environment it inherits. Even Claude Code’s Bash sandbox lets commands read most of the machine by default, ~/.ssh and ~/.aws/credentials included, until you list them. As we covered in using proxies to hide secrets from Claude Code, a key on the box is a key the agent can send somewhere.

Allowed domains can carry data out. The sandbox’s built-in proxy decides from the hostname the client asks for and, by default, doesn’t terminate or inspect TLS. Anthropic’s sandboxing docs warn that broad domains such as github.com can become exfiltration paths, and point to a custom proxy that terminates TLS when you need stronger guarantees. A domain list decides where traffic goes, never what it says.

Some actions can’t be undone. A git push to a protected repository, an enabled auto-merge or a write to a production system lands outside the box. Throwing the box away afterwards doesn’t take any of it back. These carry the most risk once the prompt is gone, and they’re where a second check pays for itself.

Injected instructions run quietly. Prompt injection doesn’t depend on the flag. With prompts on, though, an odd command at least appears in front of a person before it runs. With prompts off, instructions hidden in an issue, a README or a fetched web page can become an action that nobody sees until the logs.

The OWASP AI Agent Security Cheat Sheet recommends enforcing authorization in the component that executes actions, outside the agent’s context, and asking for approval before irreversible ones. Once the prompts are gone, that component has to be something other than the agent itself.

How to run Claude Code YOLO mode safely

Anthropic’s isolation advice is the starting point, but “no internet access” rarely survives a real task: the agent needs api.anthropic.com, your git host and a package registry. Once the box has a network, the network is where you enforce. Here’s how that looks with Formal Endpoint, an egress proxy that runs on the laptop or inside the VM next to the agent.

Start in a container or VM, as a non-root user

Give the session a VM or dev container that holds the repo and little else, and run the agent as a non-root user. That matches Anthropic’s guidance, and the root check enforces part of it. Keep sudo away from that user too: the Endpoint’s configuration docs note that a user with sudo can still stop its processes.

Inspect egress per request, not per domain

In Transparent Mode, the Endpoint intercepts connections at the operating system’s network layer and terminates TLS with a local Formal CA on the flows you select. Inside VMs and containers, the headless Linux package runs it as a systemd user service. For trust, the Endpoint writes NODE_EXTRA_CA_CERTS, SSL_CERT_FILE and REQUESTS_CA_BUNDLE into Claude Code’s ~/.claude/settings.json by default, pointing them at the Formal CA bundle.

Network rules are CEL conditions that pick which flows to intercept, by process, hostname, user and classified protocol. Anything outside every rule goes straight through, with no log entry. That makes the rule set an honest list of what’s inspected: if a destination matters, it needs a rule.

Keep API keys off the box

Credential injection takes the secret out of the session altogether. For the hosts you choose, the Endpoint hands requests to a Formal Connector along with the developer’s identity; the Connector holds the key as a Native User and attaches it on the way to the API. The agent runs with a placeholder such as ANTHROPIC_API_KEY=sk-ant-dummy. In our Stripe guide, Stripe receives the real key and the laptop never does.

Claude Code’s sandbox has a related feature for sandboxed Bash commands: masked credentials, which its local proxy swaps for the real value on outbound requests, using an experimental TLS termination setting. The difference is where the key lives. With a Connector holding it, there’s no real key on the machine for any process to read.

Block pushes, keep clones

On macOS, process.has_agent_ancestor is true for a known agent and for every process it spawns, such as git and ssh. This network rule, from our guide to blocking agent git pushes, intercepts that git traffic to GitHub:

{
  "condition": {
    "pre_tcp": process.has_agent_ancestor,
    "pre_tls": hostname in ["github.com", "ssh.github.com"],
    "post_tls": technology in ["http", "ssh"]
  }
}

A policy then blocks git-receive-pack to the repositories you list, over SSH, SSH on port 443 and HTTPS. Clones keep working, and the same push from the engineer’s own terminal goes through. Swap the block for an mfa action and the agent pauses until the user confirms on their device. The catch: ancestry relies on code-signed process identity, which only macOS has.

Catch YOLO sessions where you don’t want them

Formal policies can tell whether a session skipped its prompts. The input.agent.yolo_mode input flags agents started with --dangerously-skip-permissions. Here’s the session policy from the policy evaluation docs that blocks them:

package formal.v2

import future.keywords.if

default session := {"action": "allow"}

session := {"action": "block", "type": "block_with_formal_message"} if {
    input.agent.yolo_mode == true
}

On laptops that hold production access, that’s a sensible default. Inside a throwaway VM, skipping prompts is the point, so you’d leave the policy out there. Two limits apply: the input reflects the launch flag, so a session started with --permission-mode bypassPermissions or a settings default isn’t documented as detected, and like every policy it runs only on flows a network rule intercepts.

How do you run unattended agents in CI and cloud VMs?

Unattended agents are where the flag is most common, since nobody is around to answer a prompt. They’re also where a shared, long-lived key tends to end up in the environment. Our cloud agents guide runs the headless Endpoint inside each Cursor or Devin agent VM, signed in with the platform’s short-lived OIDC token, so there’s no Formal API key to steal.

The Endpoint configuration in that guide keeps Transparent Mode on and fails closed:

auth_mode = "oidc"

[oidc]
provider = "cursor"
integration_id = "integrationoidc_<INTEGRATION_ID>"

[transparent_proxy]
enable = true
enforce = true
fail = "closed"

enforce = true locks the commands and the tray toggle that would turn Transparent Mode off, and fail = "closed" keeps the proxy enforced if the Endpoint errors. A policy on GitHub traffic blocks both enablePullRequestAutoMerge and the REST merge endpoint, so the agent can open a pull request but can’t merge it. Process ancestry isn’t available on Linux, so the guide scopes the GitHub rule to the agents’ machine users instead.

The same OIDC sign-in accepts tokens from GitHub, AWS, Azure, GCP and SPIFFE, so CI runners get the same treatment without a stored secret. Identity is also what makes an unattended session auditable after the fact. Cursor uses Formal to scope what its Cloud Agents can reach and to tie each agent’s actions to the employee who started it:

“We’ve limited the amount of data that those cloud agents can access and we’re able to tie that back to the specific user who is using that cloud agent, which is a feature that I’m only aware of Formal having.”

— Roy Xu, Software Engineer, Security @ Cursor

At Cursor, Formal secures 1,000+ resources across 10+ technologies and handles 40M+ logs and 600K+ sessions per week. The Cursor case study covers how its security team connected Cloud Agents to internal systems that were previously off limits.

Where does this approach stop?

Network controls bound what a session without prompts can do. They don’t make the model trustworthy, and they have edges worth knowing before you rely on them:

Formal can’t make a model immune to prompt injection. What it controls is the network side: which requests an injected session gets through, and the log of everything it attempted.
Only flows that a network rule selects are inspected. Everything else passes through untouched.
input.agent.yolo_mode reflects the launch flag, not every route into bypass mode.
Process ancestry, and with it the agent-versus-engineer git rule, works on macOS only. On Linux, agent flags match process names.
On Windows, Transparent Mode and network rules aren’t available today.
None of this replaces Anthropic’s advice to isolate the session. Use both.

For the other controls Formal adds around the agent, such as skills, MCP servers and spend, see Claude Code security.

Frequently asked questions

What does dangerously-skip-permissions do in Claude Code?

It starts the session in bypassPermissions mode, so tool calls run without permission prompts, including writes to protected paths. Deny rules keep working, allow rules stop mattering, and a few actions such as critical-path rm still prompt by default. Anthropic recommends the mode only for isolated containers and VMs, and Claude Code refuses it as root on Linux and macOS.

What is the difference between auto mode and dangerously-skip-permissions?

Auto mode replaces you with a classifier model that reviews each action and blocks risky ones. From Claude Code v2.1.283, it’s the built-in starting mode for interactive terminal and VS Code sessions. --dangerously-skip-permissions removes review entirely. On a laptop, auto mode is the safer choice; YOLO mode belongs in an isolated environment where the network layer still enforces policy.

How do I give Claude Code all permissions?

Launch it with claude --dangerously-skip-permissions or claude --permission-mode bypassPermissions. That’s the supported way to skip permissions in Claude Code, and you can’t switch into it mid-session unless the session started with bypass available. If you want fewer prompts rather than all permissions, allow rules for specific tools, or auto mode, get you most of the way with far less exposure.

Is Claude Code YOLO mode safe?

YOLO mode is as safe as the environment around it. On a laptop with SSH keys, cloud credentials and open egress, one bad action runs with your full access. In a disposable VM, as a non-root user, with keys injected by a proxy and policies on the destinations that matter, a bad action has far less to work with.

Can I use dangerously-skip-permissions in VS Code?

Yes, but the VS Code extension hides the mode until you turn on the “Allow dangerously skip permissions” toggle in its settings. Without the toggle, a bypassPermissions default starts the conversation in Manual mode instead. Everything else works as in the terminal: deny rules keep blocking, and the mode belongs in an isolated environment rather than on your main laptop.

Why does Claude Code refuse dangerously-skip-permissions as root?

On Linux and macOS, Claude Code won’t start in bypass mode as root or under sudo, and prints that the flag “cannot be used with root/sudo privileges for security reasons”. The check is skipped inside a recognized sandbox. To run unattended in a container, Anthropic points to its dev container configuration, which runs Claude Code as a non-root user.

How do I stop Claude Code from pushing to main in YOLO mode?

Deny rules help, but a push can also come from a script or build tool the agent starts, as our allowlisting research showed. Block it on the network instead: a Formal network rule matches git traffic from the agent and its child processes, and a policy blocks pushes to the repositories you list while clones keep working. On macOS, the engineer’s own pushes go through.

To see these controls on your own coding agents:

Get a demo ›