claude --dangerously-skip-permissions is a command-line flag for Claude Code, Anthropic's terminal-based coding agent. It starts a session in the bypassPermissions permission mode, in which tool calls execute immediately instead of pausing for the per-action approval prompt Claude Code shows by default.[1][2] Anthropic's documentation states that the flag is equivalent to --permission-mode bypassPermissions and carries a warning restricting the mode to "isolated environments like containers, VMs, or dev containers without internet access, where Claude Code cannot damage your host system."[1] A second warning on the same page says the mode "offers no protection against prompt injection or unintended actions."[1] Developers commonly call it "YOLO mode".[10]

The flag dates to the earliest public releases of Claude Code, which reached version 1.0.0 on May 22, 2025; the changelog records a bug fix affecting the flag in version 1.0.7.[9][12] Anthropic has since shipped two features positioned as lower-risk substitutes. A sandboxed Bash tool that confines shell commands with operating-system primitives arrived in version 2.0.24, published on October 20, 2025.[9][12] Auto mode, described in an Anthropic engineering post of March 25, 2026, replaces the approval prompt with a classifier model rather than removing it, and the current documentation directs users who want fewer prompts toward auto mode instead of bypass mode.[1][8] The version numbers and behavior described here reflect Claude Code 2.1.220, published on July 24, 2026.[9][12]

Function and behavior

In Claude Code's default posture, "When Claude wants to edit a file, run a shell command, or make a network request, it pauses and asks you to approve the action."[1] The flag removes that pause for the whole session. In Anthropic's own comparison of the mechanisms that reduce permission prompts, the entry describing what replaces the prompt under --dangerously-skip-permissions is a single word: "Nothing."[3]

Three entry points activate the same mode: the flag itself, --permission-mode bypassPermissions, and permissions.defaultMode set to "bypassPermissions" in a settings file.[1] A separate flag, --allow-dangerously-skip-permissions, adds the mode to the Shift+Tab cycle without starting the session in it, so a session can begin in a stricter mode and switch later.[1][2] A session started without one of those enabling paths cannot enter the mode at all.[1]

A short list of checks survives in the mode:

Check that still applies	Documented behavior
Explicit `ask` rules	Any tool matching an `ask` rule in settings still forces a prompt[1]
Connector tools an organization has set to `ask`	Still prompt[1]
MCP tools marked `requiresUserInteraction`	Still prompt, from version 2.1.199[1]
Removals targeting the filesystem root or home directory	`rm -rf /` and `rm -rf ~` prompt as "a circuit breaker against model error"; version 2.1.208 extended the check to commands containing command substitution with `$(...)` or backticks, or process substitution[1][9]
Root and sudo refusal	On Linux and macOS Claude Code refuses to start in the mode when running as root or under `sudo`, printing that the flag "cannot be used with root/sudo privileges for security reasons". The check is skipped automatically inside a recognized sandbox[1][3]

Deny rules apply in every mode, including this one. Allow rules have no effect in bypass mode, because everything not otherwise blocked is already approved.[1]

Writes to protected paths run the other way. Claude Code maintains a list of protected directories and files, including .git, .claude, .devcontainer, .bashrc, .zshrc, .npmrc and .mcp.json, whose modification is never auto-approved in other modes. bypassPermissions is the single exception where those writes are allowed. Version 2.1.126, published on April 30, 2026, made that change; earlier versions still prompted for protected-path writes in bypass mode.[1][9][12]

Several interface details are documented. While the mode is active the CLI status bar reads ⏵⏵ bypass permissions on.[1] The first time an interactive session starts with the mode enabled, Claude Code shows a warning dialog asking the user to accept responsibility for actions taken without permission checks; the acceptance is saved to user settings so the dialog appears only once, and declining exits the program. Non-interactive runs show no dialog, and a background session started with --bg is refused until the dialog has been accepted in an interactive session.[1] In sessions where bypass permissions is available, Claude Code also stops enforcing plan mode's edit blocks: Claude is still instructed to plan without editing, but an edit or command attempted during planning runs without a prompt.[1] Claude Code on the web ignores defaultMode: "bypassPermissions" from settings files, so a repository's checked-in configuration cannot start a cloud session in the mode.[1]

The permission system it bypasses

Permission modes set the baseline for how often Claude Code stops to ask. As of version 2.1.220 the documented modes are:[1]

Mode	What runs without asking	Documented use
`default`	Reads only	Getting started, sensitive work
`acceptEdits`	Reads, file edits, and common filesystem commands such as `mkdir`, `touch`, `rm`, `rmdir`, `mv`, `cp` and `sed`, within the working directory	Iterating on code under review
`plan`	Reads, plus classifier-approved commands where auto mode is available	Exploring a codebase before changing it
`auto`	Everything, with background safety checks by a classifier model	Long tasks, reducing prompt fatigue
`dontAsk`	Only pre-approved tools; everything else is auto-denied	Locked-down CI and scripts
`bypassPermissions`	Everything	"Isolated containers and VMs only"

The mode whose configuration value is default has been labeled Manual in the CLI, claude --help, and the VS Code and JetBrains extensions since version 2.1.200, published on July 3, 2026; manual is accepted as an alias for the value.[1][9][12]

Layered on top of the modes are allow, ask and deny rules, which can be written in user, project or managed settings files and matched by tool and by command or resource pattern.[6] Deny rules take precedence at every level, and a deny set in managed settings cannot be overridden by --allowedTools on the command line.[6] This layering is what makes bypass mode partially configurable rather than absolute: an organization or an individual can leave a narrow set of operations gated even in a session that otherwise asks nothing.

Intended use and Anthropic's guidance

Anthropic's guidance is that the flag is appropriate only where an isolation boundary substitutes for the removed prompt. The documentation on choosing a sandbox environment puts it directly: "With no prompts to catch mistakes, the isolation boundary you choose is what protects your system. Always run --dangerously-skip-permissions sessions inside a container, a VM, or the sandbox runtime, so that file tools, MCP servers, and hooks are also inside the boundary."[4] The same page notes that the built-in Bash sandbox on its own "constrains only Bash, so it is not sufficient for fully unattended runs in either mode", because the built-in file tools, Model Context Protocol servers and hooks run outside it.[4]

The dev container documentation describes the sanctioned pattern. "Because the container runs Claude Code as a non-root user and confines command execution to the container, you can pass --dangerously-skip-permissions for unattended operation," it says, adding that the CLI rejects the flag when launched as root, so the container's remoteUser must be a non-root account.[7] Anthropic publishes a reference dev container in the anthropics/claude-code repository combining the CLI, persistent volumes and an init-firewall.sh script that blocks outbound traffic except to an allowlist; the firewall requires the NET_ADMIN and NET_RAW capabilities and is described as a working example rather than a maintained base image.[7]

The limits of that pattern are documented alongside it. A dev container "does not prevent a malicious project from exfiltrating anything accessible inside the container, including the Claude Code credentials stored in ~/.claude", and Anthropic advises using dev containers only with trusted repositories and avoiding mounting host secrets such as ~/.ssh or cloud credential files.[7] Skipping prompts inside a container also does not protect the project itself: Claude "can still modify any file in the bind-mounted workspace, which appears directly on your host, and reach anything the container's network policy allows."[7]

Documented risks

Anthropic's security documentation frames the underlying exposure without reference to any particular mode: Claude Code "only has the permissions you grant it", and the user is "responsible for reviewing proposed code and commands for safety before approval."[5] Removing the review step is therefore a transfer of that responsibility to whatever boundary contains the session.

The risk Anthropic names most often in connection with the mode is prompt injection, in which instructions hidden in a file, a web page, an issue comment, a dependency or a tool response are read by the agent and acted on. Claude Code's documented mitigations include isolated context windows for web fetches, command-injection detection, fail-closed matching for unmatched commands, and the requirement that network-fetching commands such as curl and wget be approved rather than auto-approved.[5] Several of those mitigations are permission prompts, which the flag removes. Anthropic's general caveat applies with more force in this mode: "While these protections significantly reduce risk, no system is completely immune to all attacks."[5]

Destructive and overreaching commands are the second documented failure mode. The circuit breaker for removals targeting / or the home directory exists specifically as a safety net "against model error", which is an acknowledgement that the model can generate such a command.[1] Anthropic's engineering post on auto mode is more concrete about the pattern. "We keep an internal incident log focused on agentic misbehaviors," it says. "Past examples include deleting remote git branches from a misinterpreted instruction, uploading an engineer's GitHub auth token to an internal compute cluster, and attempting migrations against a production database. Each of these was the result of the model being overeager, taking initiative in a way the user didn't intend."[8] Those actions are the class of behavior a permission prompt is positioned to catch and that bypass mode removes the opportunity to catch.

Credential exposure and supply-chain reach are documented as properties of the environment rather than of the flag. Sandboxed Bash commands inherit the parent process environment by default, and the sandbox's default read policy "still allows reading credential files such as ~/.aws/credentials and ~/.ssh/" unless those paths are added to a deny list or the sandbox.credentials setting.[3] Anthropic also warns that allowing broad network domains such as github.com "can create paths for data exfiltration", because the built-in proxy makes its allow decision from the client-supplied hostname without inspecting TLS.[3]

A reflexive detail is that Claude Code's own auto mode classifier blocks the flag by default. Among the actions the classifier refuses without explicit instruction is "Launching an autonomous agent loop that runs without human approval or a sandbox, such as one started with --dangerously-skip-permissions or --no-sandbox."[1]

Isolation and lower-risk alternatives

Anthropic documents six isolation approaches, distinguished by what falls inside the boundary:[4]

Approach	What is isolated	Requires Docker
Sandboxed Bash tool	Bash commands and their child processes	No
Sandbox runtime	The whole Claude Code process, including file tools, MCP servers and hooks	No
Dev container	Full development environment	Yes
Custom container	Full development environment	Yes
Virtual machine	Full operating system	No
Claude Code on the web	Full operating system, hosted by Anthropic	No

The built-in Bash sandbox, enabled with the /sandbox command, uses Seatbelt on macOS and bubblewrap with socat on Linux and WSL2. Native Windows and WSL1 are not supported. By default sandboxed commands can write only to the working directory and the session temporary directory, read access covers the rest of the machine except denied paths, and no network domains are pre-allowed: the first connection to a new domain prompts.[3] Anthropic publishes the same primitives as the standalone @anthropic-ai/sandbox-runtime package, which wraps an entire process rather than individual commands and is described as a beta research preview.[3][4] The sandboxing documentation states plainly that the mechanism "reduces risk but is not a complete isolation boundary."[3]

Auto mode is the alternative Anthropic recommends for interactive work. The March 2026 engineering post describes the design problem as approval fatigue, "where people stop paying close attention to what they're approving", and reports that "Claude Code users approve 93% of permission prompts."[8] The post describes the two prior options as a built-in sandbox or "the --dangerously-skip-permissions flag that disables all permission prompts and lets Claude act freely, which is unsafe in most situations", and presents auto mode as a mode that "delegates approvals to model-based classifiers", positioned between manual review and no guardrails.[8]

The published architecture has two layers: a server-side probe that "scans tool outputs (file reads, web fetches, shell output, external tool responses) before they enter the agent's context", and a transcript classifier that runs "a fast single-token filter (deciding 'yes' to block or 'no' to allow), followed by chain-of-thought reasoning only if the first filter flags."[8] Anthropic reported the classifier running on Sonnet 4.6 at launch and published the deployed pipeline's measured rates: a 0.4% false-positive rate on a sample of real internal traffic, meaning actual Claude Code tool calls from Anthropic employees (n=10,000), a 17% false-negative rate on a set of real overeager actions (n=52), and a 5.7% false-negative rate on synthetic exfiltration attempts (n=1,000). The post calls the 17% figure "the honest number" and attributes most misses to the classifier recognizing the danger but misjudging whether something the user said actually authorised the action.[8] By July 2026 the documentation stated that the classifier runs on Claude Sonnet 5 by default.[1] Auto mode is available on all plans, and its model requirements differ by provider: on the Anthropic API it needs Claude Opus 4.6 or later, Sonnet 4.6 or later, or Fable 5, while on Amazon Bedrock, Google Cloud's Agent Platform and Microsoft Foundry only Sonnet 5, Opus 4.7 or later, and Fable 5 are supported.[1] The documentation carries its own warning that auto mode "reduces permission prompts but does not guarantee safety."[1]

The two mechanisms address different questions. Anthropic's comparison table distinguishes the sandbox, which "controls what a Bash command can access once it runs", from auto mode and the flag, which control "whether each tool call runs"; only the flag has nothing in the place of the prompt.[3]

Organizational controls

Administrators can prevent the mode from being used. Setting permissions.disableBypassPermissionsMode to "disable" blocks it, and the documentation notes that the setting "is typically placed in managed settings to enforce organizational policy, but it works from any scope", so an individual user can also set it to lock themselves out.[1][6] Managed settings sit at the top of the settings hierarchy and "can't be overridden by any other level, including command line arguments".[6] Since version 2.1.69 the VS Code permission-mode picker hides bypass mode when the setting is applied.[9] A parallel setting, permissions.disableAutoMode, turns off auto mode the same way.[1][6]

Managed settings can also require sandboxing rather than merely permitting it. The documented configuration combines sandbox.enabled, sandbox.failIfUnavailable to refuse to start when the sandbox cannot initialize, and allowUnsandboxedCommands: false to disable the dangerouslyDisableSandbox escape hatch by which Claude may retry a failed command outside the sandbox.[3] The built-in Bash sandbox is, in Anthropic's words, "the only approach Claude Code enforces itself"; dev containers and custom images are conventions that have to be enforced through device management or software allowlisting instead.[4]

Reception and community practice

Practitioner accounts have consistently paired enthusiasm about the workflow with insistence on a sandbox. Summarizing a June 2025 talk by Armin Ronacher, Simon Willison wrote that "Armin runs Claude Code with the --dangerously-skip-permissions option, and says this unlocks a huge amount of productivity", adding for himself: "I haven't been brave enough to do this yet but I'm going to start using that option while running in a Docker container to ensure nothing too bad can happen."[11]

In an October 2025 post titled "Living dangerously with Claude", Willison described the experience of the mode as qualitatively different from the default: "Claude Code running in this mode genuinely feels like a completely different product from regular, default Claude Code", because it allows a user to "leave Claude alone to solve all manner of hairy problems while you go and do something else entirely."[10] His stated security position in the same piece is that "The only solution that's credible is to run coding agents in a sandbox", and that "The best sandboxes are the ones that run on someone else's computer!"[10] Willison grounds the argument in his "lethal trifecta" framing, the combination of access to private data, exposure to untrusted content, and the ability to communicate externally, and in the observation that "anyone who can get their tokens into your context should be considered to have full control over what your agent does next, including the tools that it calls."[10] Cutting off network egress, on this reading, matters because it removes the exfiltration leg of that combination.[10]

Comparable flags exist in other agentic coding tools, including --yes-always in Aider and the full-automatic modes of OpenAI Codex CLI. Anthropic's auto mode classifier treats a third-party agent or evaluation harness "with isolation and per-action approval disabled, such as a runner started with --yes-always" as an action to block by default, placing those flags in the same category as its own.[1]

See also

References

Anthropic. "Choose a permission mode." Claude Code documentation. Accessed August 1, 2026. https://code.claude.com/docs/en/permission-modes
Anthropic. "CLI reference." Claude Code documentation. Accessed August 1, 2026. https://code.claude.com/docs/en/cli-reference
Anthropic. "Configure the sandboxed Bash tool." Claude Code documentation. Accessed August 1, 2026. https://code.claude.com/docs/en/sandboxing
Anthropic. "Choose a sandbox environment." Claude Code documentation. Accessed August 1, 2026. https://code.claude.com/docs/en/sandbox-environments
Anthropic. "Security." Claude Code documentation. Accessed August 1, 2026. https://code.claude.com/docs/en/security
Anthropic. "Configure permissions." Claude Code documentation. Accessed August 1, 2026. https://code.claude.com/docs/en/permissions
Anthropic. "Development containers." Claude Code documentation. Accessed August 1, 2026. https://code.claude.com/docs/en/devcontainer
Anthropic Engineering. "How we built Claude Code auto mode: a safer way to skip permissions." March 25, 2026. https://www.anthropic.com/engineering/claude-code-auto-mode
Anthropic. Claude Code CHANGELOG. https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md
Simon Willison. "Living dangerously with Claude." October 22, 2025. https://simonwillison.net/2025/Oct/22/living-dangerously-with-claude/
Simon Willison. "Agentic Coding: The Future of Software Development with Agents." June 29, 2025. https://simonwillison.net/2025/Jun/29/agentic-coding/
npm registry. Release metadata for @anthropic-ai/claude-code (publication dates for versions 1.0.0, 2.0.24, 2.1.126, 2.1.200, 2.1.208 and 2.1.220). https://registry.npmjs.org/@anthropic-ai/claude-code

Editing: Claude --dangerously-skip-permissions