Claude dangerously skip permissions: what the flag does and how to run Claude unattended safely

claude --dangerously-skip-permissions starts Claude Code in bypassPermissions mode: tool calls run without asking you, including file edits, shell commands, network requests and writes to protected folders like .git and .claude. Anthropic's docs say to use it only inside an isolated container or VM. For most hands-off work, auto mode, allow rules or the Bash sandbox remove the prompts you hit without handing Claude your whole machine.

What the flag does

The flag is a shortcut for one permission mode. These two commands are equivalent:

claude --dangerously-skip-permissions
claude --permission-mode bypassPermissions

A few details matter in practice (as of October 2026):

• The first time you start an interactive session with it, Claude Code shows a warning dialog. Accepting writes "skipDangerousModePermissionPrompt": true to ~/.claude/settings.json, so you don't see it again. Declining exits.
• On Linux and macOS it refuses to start as root or under sudo, unless Claude Code detects that it already runs inside a recognized sandbox.
• --allow-dangerously-skip-permissions adds bypass mode to the Shift+Tab cycle without starting in it, so you can plan first and switch later.
• With claude -p (non-interactive mode) there is no dialog, which is why the flag shows up in scripts, CI and scheduled jobs.
• "defaultMode": "bypassPermissions" under permissions in ~/.claude/settings.json makes it your default. The same value in a project's .claude/settings.json is ignored, so a repository you clone can't switch it on for you.

What still stops it

Bypass mode skips prompts, not every check. These still apply:

• Deny rules in your settings block matching calls. Allow rules do nothing in this mode, since everything is already allowed.
• PreToolUse hooks that return a deny decision still block the call. This is the strongest guardrail you can add (example below).
• Explicit ask rules still prompt, and Claude can still stop to ask you a question.
• Removing a critical path such as your home folder, the filesystem root or your working directory still asks first. In a terminal that prompt has a two-minute countdown and is denied if nobody answers, so an unattended run keeps going.

In a claude -p run, the few calls that would still prompt are denied instead.

The risks, concretely

The name is honest. With no prompts, three things can go wrong while nobody watches:

1. Prompt injection. A README, issue comment, web page or package script that Claude reads can contain instructions. Anthropic's permission docs state plainly that bypass mode offers no protection against prompt injection.
2. Ordinary mistakes at full speed. A force push, a dropped table on the wrong database URL, a git reset --hard over work you hadn't committed. In bypass mode even writes to .git, .bashrc and .npmrc go through without a prompt.
3. Reach. Claude runs as you. Outside a container it can read ~/.ssh, your cloud credentials and every other repository in your home folder, and anything with network access can send what it reads elsewhere.

A container limits the damage to what is inside it, not to zero. Anthropic's dev container page warns that it does not stop a malicious project from exfiltrating anything in the container, including your Claude Code credentials. Mount only what the task needs, and only use it with repositories you trust.

Safer options, from lightest to strongest

Most people reach for the flag because of prompt fatigue. Pick the lightest option that removes the prompts you actually hit:

A typical allow list for a Node project, in .claude/settings.json:

{
  "permissions": {
    "allow": ["Bash(npm run *)", "Bash(npx vitest *)", "Bash(git diff *)", "Bash(git commit *)"],
    "deny": ["Bash(git push *)", "Read(./.env)", "Read(./secrets/**)"]
  }
}

The space before * matters: Bash(npm run *) matches npm run test but not npm install. Deny rules always win over allow rules.

Know the limits of each layer. The Bash sandbox covers shell commands only; Claude's file tools, MCP servers and hooks run outside it, so the docs say it isn't enough on its own for fully unattended runs. A worktree isolates files, not credentials. Treat it as tidiness, not security.

Run Claude unattended the safe way

If you do want zero prompts, this is the setup the docs point to.

1. Put Claude Code in a container. Anthropic's docs point to a dev container, which runs Claude Code as a non-root user (bypass mode refuses root). The official dev container feature installs it; save this as .devcontainer/devcontainer.json and rebuild:

{
  "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
  "features": {
    "ghcr.io/anthropics/devcontainer-features/claude-code:1.0": {}
  }
}

Don't mount ~/.ssh or cloud credential files into it. Prefer a token scoped to the one repository.

2. Add a deny hook for the commands you never want. It keeps working with the flag on. Save it as .claude/hooks/block-dangerous.sh, run chmod +x on it, and make sure jq is installed:

#!/bin/bash
cmd=$(jq -r '.tool_input.command // empty')
if printf '%s' "$cmd" | grep -Eiq 'git push.*( -f| --force)|terraform (apply|destroy)|drop (table|database)'; then
  jq -n --arg r "Blocked by policy hook: $cmd" \
    '{hookSpecificOutput: {hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: $r}}'
fi
exit 0

Register it in .claude/settings.json:

{
  "hooks": {
    "PreToolUse": [
      { "matcher": "Bash", "hooks": [{ "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/block-dangerous.sh" }] }
    ]
  }
}

3. Bound the run. In print mode you can cap turns and estimated spend, and keep the push for yourself:

claude -p "Upgrade vitest to the latest major, fix what breaks, commit on this branch. Do not push." \
  --dangerously-skip-permissions --max-turns 40 --max-budget-usd 5 --output-format json > run.json

If you would rather keep a safety net, run the same job in auto mode and tell Claude Code that nobody is around to answer. Anything that would have prompted is denied instead of waiting (--permission-prompts needs Claude Code v2.1.259 or later):

claude -p "Update the dependency pins and run the tests" --permission-mode auto --permission-prompts none

Know when the run finishes or gets stuck

Unattended rarely means "never needs you". Claude stops on a critical-path removal, an ask rule or a question it can't answer alone, or it simply finishes while you are in a meeting. Three ways to find out without watching the terminal:

• A hook. A Stop or Notification hook can show a desktop notification or curl a message to ntfy or Telegram. The notifications guide has copyable versions, and the hooks guide explains each event.
• Remote Control. Start the session with claude --remote-control and the Claude app can push to your phone when it needs a decision. See Claude Code remote control.
• A status board. Briefkin's one-command installer adds a hook to Claude Code (and to Codex, Cursor and other agents) that keeps one card per session: working, waiting for permission or input, done. It pings you on Telegram only when a session is waiting on you, and a prompt you answer at the keyboard within two minutes never reaches your phone. Setup is in the docs.

Codex's equivalent: yolo mode

OpenAI's Codex CLI has the same escape hatch: codex --yolo, an alias for --dangerously-bypass-approvals-and-sandbox. It turns off both approvals and Codex's own sandbox, and OpenAI's command reference says to use it only inside an environment that is hardened from the outside. For low-friction local work, the same reference suggests a sandboxed mode that asks when it needs to:

codex --sandbox workspace-write --ask-for-approval on-request

The same rule holds for both tools: skip the prompts only where the blast radius is a box you can throw away.