Claude Dangerously Skip Permissions: Risks and Safer Options

Claude's dangerously skip permissions flag, claude --dangerously-skip-permissions, starts Claude Code with every permission prompt turned off. Claude can edit any file, run any shell command and call any tool without asking you first. It's the same as --permission-mode bypassPermissions, and Anthropic says to use it only in isolated environments like containers or VMs, because it "offers no protection against prompt injection or unintended actions."

You probably don't need it. Since version 2.1.283, Claude Code starts interactive sessions in auto mode by default, where a separate safety model approves routine actions for you and blocks risky ones. Most people reaching for the flag want fewer prompts, and auto mode or the sandbox gets them that with far less risk.

How we researched this: Claude Code's permission modes docs, permissions, sandboxing, dev container and hooks docs, the CLI reference, the official changelog and Anthropic's engineering posts, checked October 28, 2026.

What does dangerously skip permissions do?

It puts Claude Code in bypass mode. Per the CLI reference, the flag means "Skip permission prompts", equivalent to --permission-mode bypassPermissions. In that mode, tool calls run immediately, including writes to paths Claude Code normally protects, such as .git, .claude, .bashrc, .zshrc and .npmrc.

claude --dangerously-skip-permissions

The first time you use it, Claude Code shows a warning you have to accept. On Linux and macOS it also refuses to run as root or with sudo, with the message that the flag "cannot be used with root/sudo privileges for security reasons."

There's a related flag, --allow-dangerously-skip-permissions. It adds bypass mode to the Shift+Tab mode cycle without starting in it, so you can switch in only when you need to:

claude --permission-mode plan --allow-dangerously-skip-permissions

What does bypass mode still block?

Fewer things than most people assume, but not nothing. Per the permission modes docs and the hooks guide, even with the flag on:

• Deny rules in your settings still block. They apply in every mode.
• A PreToolUse hook that returns "deny" still blocks the tool.
• Tools you've set to "ask" with an explicit rule still ask.
• Recognized dangerous deletes, such as rm -rf ~ or removing other critical paths, still prompt or get denied.
• Questions Claude asks you directly still wait for your answer.

Allow rules, on the other hand, do nothing in bypass mode, since everything is already allowed. So deny rules and hooks are your only guardrails once the flag is on.

Claude Code permission modes compared

Bypass is one of six modes. Here's what each one lets Claude do without asking:

You can also set a default in settings with "permissions": {"defaultMode": "acceptEdits"}. The command-line flag overrides it for that session.

When is it OK to skip permissions?

When the machine Claude runs on is disposable and holds nothing you'd mind losing or leaking. Anthropic's own wording is to use bypass "in isolated environments like containers, VMs, or dev containers without internet access, where Claude Code cannot damage your host system."

Good fits:

• A fresh container or VM for a long, unattended refactor or test-fixing run.
• A throwaway cloud machine with a cloned repo and no production credentials.
• CI jobs in an ephemeral runner, with network access limited to what the build needs.

Bad fits:

• Your everyday laptop, with your SSH keys, cloud credentials and browser sessions on it.
• Any repo you didn't write or don't fully trust, since its files can carry prompt injections.
• Sessions with MCP servers that read web pages, email or tickets. Our guide to what an MCP server is covers why outside content is the main injection risk.

Is a dev container enough?

It helps a lot, but read the fine print. Anthropic publishes a reference dev container with a firewall script that limits outbound traffic to allowed destinations. The docs still warn:

When executed with --dangerously-skip-permissions, dev containers do not prevent a malicious project from exfiltrating anything accessible inside the container, including the Claude Code credentials stored in ~/.claude.

Two more limits matter. Your project folder is usually bind-mounted, so Claude can still change files that appear directly on your host. And anything you mount in, like ~/.ssh or cloud credential files, is exposed. Anthropic suggests repository-scoped or short-lived tokens instead.

Safer ways to get fewer prompts

Pick by what's actually annoying you:

Auto mode

Auto mode sends each action that isn't clearly safe to a separate classifier model. It blocks things that go beyond your request, target infrastructure it doesn't recognize, or look driven by content Claude read. Blocked by default: piping curl into bash, sending sensitive data out, production deploys and migrations, git reset --hard, force pushes and terraform destroy.

It isn't perfect, and Anthropic is upfront about that. Its auto mode engineering post from March 2026 reports that people approved 93% of manual prompts anyway. It also reports the classifier missed 17% of real overeager actions in its tests, calling that "the honest number".

That's still far better than bypass, which checks nothing. If the classifier blocks 3 actions in a row or 20 in total, auto mode pauses and goes back to asking you.

On Team and Enterprise plans, admins can turn it off.

The sandbox

Run /sandbox to turn on OS-level isolation for shell commands. Writes are limited to your project and temp folders, and network traffic goes through a proxy that only allows domains you list. Anthropic's sandboxing post says it cut permission prompts by 84% in internal use.

It works on macOS, Linux and WSL2. On native Windows, commands run unsandboxed. One gap to close: by default, sandboxed commands can still read most of your machine, including ~/.ssh and ~/.aws/credentials, so add those to sandbox.filesystem.denyRead.

Allow and deny rules

Rules in .claude/settings.json let routine commands through and stop dangerous ones:

{
  "permissions": {
    "allow": ["Bash(npm run *)", "Bash(git commit *)"],
    "deny": ["Bash(git push *)", "Read(./.env)", "Read(./secrets/**)"]
  }
}

Rules are checked in the order deny, then ask, then allow. Don't treat Bash deny rules as a security boundary, though. The permissions docs note that Bash(curl *) won't catch /usr/bin/curl or sh -c '...'. For hard limits, use the sandbox.

A hook that blocks destructive commands

Hooks run before the permission check in every mode, including bypass. This PreToolUse hook blocks two destructive patterns. It goes in .claude/settings.json:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          { "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/block-destructive.sh" }
        ]
      }
    ]
  }
}

And the script, .claude/hooks/block-destructive.sh:

#!/bin/bash
COMMAND=$(jq -r '.tool_input.command')
if echo "$COMMAND" | grep -qE 'rm -rf|git push --force'; then
  echo "Blocked by hook: destructive command" >&2
  exit 2
fi
exit 0

Exit code 2 blocks the call and shows your message to Claude, which then tries another way. Make the script executable with chmod +x.

Using Claude Code without prompts in scripts and CI

For claude -p, pre-approve exactly the tools the job needs instead of skipping everything:

claude -p "Find and fix the failing test in auth.py" --allowedTools "Read,Edit,Bash(npm test *)"

For a fully unattended run, the headless docs suggest auto mode with prompts turned off, so anything the classifier won't approve is denied instead of waiting:

claude -p "Update the changelog" --permission-mode auto --permission-prompts none

Our Claude Code pricing guide covers what long unattended runs cost on the API.

How to block bypass mode for a team

Admins can stop anyone from using the flag. Add this to managed settings, which users can't override:

{
  "permissions": {
    "disableBypassPermissionsMode": "disable"
  }
}

The same works for auto mode with disableAutoMode. On Linux, managed settings live in /etc/claude-code/managed-settings.json.

FAQ

Is --dangerously-skip-permissions safe?

Only in an isolated, disposable environment. On your own computer it lets Claude run any command and change any file without asking, and Anthropic says it offers no protection against prompt injection.

What's the difference between bypass mode and auto mode?

Bypass mode approves everything with no checks. Auto mode approves routine actions automatically but sends risky ones to a safety classifier, which can block them. Auto mode is the default for interactive sessions since Claude Code 2.1.283.

Why won't --dangerously-skip-permissions run as root?

Claude Code refuses the flag under root or sudo on Linux and macOS, for security reasons. Run Claude Code as a normal user, and inside a container use a non-root user.

How do I turn off permission prompts in Claude Code?

Switch to auto mode with Shift+Tab or --permission-mode auto for most work. Use --dangerously-skip-permissions only in a container or VM. To stop prompts for specific commands, add allow rules in .claude/settings.json.

Does Codex have a similar flag?

The closest match in OpenAI's Codex is running with the danger-full-access sandbox mode and the never approval policy. Codex's sandbox is on by default, unlike Claude Code's. Our Claude Code vs Codex comparison covers both agents' approval and sandbox settings.