Claude Code can ask for your approval before editing a file or running a shell command. On a long task, the agent repeatedly stops to wait for approval. The --dangerously-skip-permissions flag turns most of those prompts off and lets the agent work without you approving each tool call.
Whether that's safe depends on where the agent runs and what it can access. On your laptop, an agent with no prompts and no additional restrictions can reach the files and credentials your account can. Isolation and restricted network access limit the damage a mistake can cause, although permitted resources remain exposed.
To contain a bypass session, first understand which checks the flag turns off.
Copy link to headingWhat is the Claude Code dangerously skip permissions flag?
The Claude Code dangerously skip permissions flag is a startup option that puts a session in bypass permissions mode, the same mode --permission-mode bypassPermissions selects. In this mode, Claude Code runs most tool calls without asking first, including edits to folders it normally guards, such as .git and .claude. Allow rules no longer affect approval because bypass mode already allows calls that reach that step. Developers use the flag in long terminal sessions, where Claude Code chains shell commands, tests, and Git operations. A prompt at each step pauses that work.
A few safety checks still apply. Commands you've blocked with a deny rule stay blocked, and commands you've set to always ask still prompt in interactive sessions. Deleting a critical location, such as the filesystem root, with rm or rmdir still asks for approval in the terminal by default. In the desktop app and VS Code, it's denied by default. Working-directory restrictions also apply in bypass mode. permissions.blockReadsOutsideWorkingDirectories (v2.1.257+) restricts file-tool reads, and permissions.blockWritesOutsideWorkingDirectories (v2.1.314+) restricts file-tool writes, with documented exceptions. These settings do not provide whole-process isolation. On Linux and macOS, Claude Code also refuses to start in this mode as root or with sudo, unless it's inside a recognized sandbox.
Copy link to headingHow does skipping permissions differ from auto mode?
Both reduce approval prompts, but auto mode replaces most approvals with a safety check, while bypass mode retains the exceptions above and other checks that require user interaction. In auto mode, your own allow, ask, and deny rules generally apply first, though Claude Code drops broad execution allow rules. Reads and edits inside your working directory run directly except where additional checks apply. Most other actions go to a classifier model. It is designed to block actions that go beyond your request, target systems it doesn't recognize, or appear to follow hostile instructions Claude read in a file or web page.
Neither mode isolates the agent. The classifier judges one action at a time. A manual prompt doesn't isolate it either. Anthropic's March 2026 analysis reported that users accepted 93% of permission prompts. Approval alone doesn't restrict a command's access. A whole-process sandbox, container, or virtual machine (VM) limits what the agent can reach. Anthropic recommends one for bypass mode, and auto mode still benefits from one in unattended runs.
Manual, auto, don't ask, and bypass modes differ in what checks each tool call before it runs:
Both dontAsk and bypass can run without a person present, but dontAsk mode denies calls that would otherwise need approval. It still runs actions that need no approval and calls approved by rules, hooks, or supported mods.
Copy link to headingWhat can an agent do when permissions are skipped?
With prompts off, an agent can act within the access your account, its tokens, and any remaining controls allow, before anyone reviews the command:
Change shared Git history: An agent can push wherever its credentials permit. With sufficient repository administration or bypass privileges, it may also change or bypass branch protection rules.
Erase local work: A recursive delete can wipe a working directory, including commits that were never pushed. Claude Code's delete checks look at the target path, not at whether the work has a backup.
Delete production data: With a sufficiently privileged token in reach, an agent can delete production resources.
Hand your files to an attacker: Hostile code can launch the agent itself. Malware in compromised Nx packages attempted to run
claude --dangerously-skip-permissionsto list sensitive files on the machine for the attacker to collect, as documented in the s1ngularity investigation.
Running the agent in a lightweight virtual machine (microVM) isolates its execution from your laptop's files and Git checkout, provided you don't expose those resources to it. It doesn't prevent misuse of a production token or exfiltration of readable data through permitted destinations, so containment also needs egress limits and scoped credentials the agent can't extract.
Copy link to headingCreating a safe Claude Code bypass permissions setup
Configure these layers before enabling the flag. Each addresses a gap the others leave open.
Copy link to headingA boundary around the whole Claude Code process
Anthropic recommends running bypass sessions inside a container, a VM, or its sandbox runtime. Each of those puts file tools, hooks, and locally launched Model Context Protocol (MCP) servers inside the boundary along with shell commands. Remote MCP services remain external. Claude Code's built-in sandboxed Bash tool constrains only shell commands, while file tools, MCP servers, and hooks keep running on your host. On its own, it is insufficient for unattended runs.
Copy link to headingAn egress policy that defaults to deny
An egress policy controls which outbound connections leave the boundary. An isolated agent with unrestricted egress can still send out anything it can read. Anthropic's reference dev container includes a firewall script that limits outbound traffic to the destinations it lists, which makes it a reasonable starting point for unattended runs.
Default-deny egress suits sessions that access secrets, personal data, or private source code. Installs and API calls fail until you allow their hosts. Claude Code's built-in proxy filters destinations by hostname and doesn't inspect Transport Layer Security (TLS) traffic by default. Optional TLS termination supports controls such as credential masking. Prefer a short, regularly reviewed allowlist over a broad one.
Copy link to headingA credential layer outside the boundary
Keys and tokens made available inside the boundary are within the agent's reach unless additional controls block or mask them. Claude Code's dev container docs warn that a container running the flag won't stop a malicious project from exfiltrating accessible data inside it, including the Claude Code credentials stored in ~/.claude.
Leave ~/.ssh and cloud credential files unmounted, and prefer repository-scoped or short-lived tokens. For higher-risk work, a proxy outside the boundary can attach the credential to outbound requests, so the agent can use it without receiving the secret. The proxy adds a service to operate and is useful when a session uses credentials you can't rotate promptly.
Copy link to heading4 best practices to skip Claude Code permissions safely
A long session doesn't automatically need the flag. Choose the mode for the job, and reserve bypass for sessions inside an isolation boundary.
Copy link to headingStart with auto mode
Auto mode addresses the prompt fatigue that makes the flag tempting in interactive sessions. It launched as a research preview in March 2026 and became the default for Claude Pro, Max, and Team plans on August 14, 2026. From v2.1.283, current defaults start interactive terminal and VS Code sessions in auto mode across plans and providers, subject to configuration and availability. Eligible sessions under the Health Insurance Portability and Accountability Act (HIPAA) configuration still start in Manual from v2.1.285.
If the classifier blocks actions 3 times in a row or 20 times in a session, Claude Code pauses auto mode and resumes prompting in interactive sessions. The interactive session then waits for a person instead of continuing unattended. A non-interactive run without a permission-prompt tool denies the action and continues working.
Copy link to headingGrant scoped allow lists in CI instead
Continuous integration (CI) runs have nobody to approve a prompt, which pushes developers toward the flag. A scoped allow list lets the job run unattended while keeping permission checks. With --permission-mode dontAsk, claude -p runs actions that need no approval and calls approved by rules, hooks, or supported mods, then denies calls that would still prompt.
The following CI step authorizes the test command. The allow rule does not sandbox the scripts that npm test executes:
claude -p "run the test suite" --permission-mode dontAsk --allowedTools "Bash(npm test)" "Read"From v2.1.302, claude -p with no mode selected by flags or settings starts in Manual and denies calls that need approval unless a rule, hook, or supported approval mechanism approves them. The Claude Code GitHub Action gives a plain-text prompt-driven automation run no shell or GitHub API access until you grant tools through --allowedTools or permissions.allow. --max-turns caps the number of conversation turns.
The v2.1.319 release also added permissions.denyInsteadOfPrompting, which denies calls that would otherwise wait for approval in terminal sessions, subagents, and teammates.
Copy link to headingKeep hooks and deny rules on inside the sandbox
Some commands should never run, even inside a sandbox, such as a force push to a shared branch. A deny rule such as Bash(git push --force *) blocks matching command text even with prompts off. Other forms of the same push may not match the rule. A PreToolUse hook, a script Claude Code runs before a matching tool call, can inspect the full command and return permissionDecision: "deny" for variants it recognizes.
The Claude Agent SDK, a library for running Claude Code from your own code, applies the same rules. Its allowed_tools setting has no effect on approvals in bypass mode. Its disallowed_tools setting still blocks specific tools or command patterns, so deny lists remain worth maintaining.
Copy link to headingMove unattended runs off your laptop
An unattended agent on your laptop stops when the lid closes and shares hardware resources with your other applications. Conductor runs parallel coding agents, including Claude Code, for engineering teams at Notion, Linear, Ramp, and Life360, and every one of those agents used to run on the developer's own machine. To remove that dependency, Conductor built Cloud Workspaces, its remote execution layer, on Vercel Sandbox.
Copy link to headingHow Vercel contains Claude Code when permissions are skipped
Vercel Sandbox runs a bypass session off your laptop, with configurable network and credential-brokering controls enforced outside the agent's reach. Notion runs every Notion Worker, code generated by third-party developers and agents, in its own Sandbox microVM for the same reason. Sandbox isolation itself doesn't change what Claude Code checks or what it sends to the model, so you still choose the permission mode and deny rules.
Copy link to headingRun each Claude Code session in its own microVM with Vercel Sandbox
A bypass session needs a machine where a wrong command can't directly touch host files or other projects that haven't been exposed to it. Each Vercel Sandbox runs in a dedicated Firecracker microVM with its own guest kernel, filesystem, and network. During Vercel's $1M Sandbox challenge, Trail of Bits assessed the virtualization architecture as sound, but the challenge also uncovered vulnerabilities, including a kernel zero-day, which were promptly mitigated. Vercel reported no demonstrated access to customer files, secrets, or application data.
With Sandbox CLI 4.8.0 or later, npx sandbox@latest create claude starts Claude Code in a new sandbox with its interface in your local terminal. None of your project files are uploaded until you clone or copy them in. A single session runs up to 45 minutes on the Vercel Hobby plan and 24 hours on Pro and Enterprise under the current session limits.
Copy link to headingLock outbound traffic outside the VM with the Sandbox firewall
Default-deny egress works only if the agent can't edit the rules. If the agent has the privileges needed to manage a firewall inside the VM, it can change those rules. The Sandbox firewall runs on the host, outside the microVM, and every firewall feature is available on all plans.
Sandboxes start with the default allow-all policy, which suits setup work. deny-all blocks every outbound connection, including Domain Name System (DNS) lookups, and a user-defined policy allows only the domains or address ranges you list. The following option creates a sandbox with no outbound access. It also blocks a direct model connection from Claude Code:
import { Sandbox } from '@vercel/sandbox';
const sandbox = await Sandbox.create({ networkPolicy: 'deny-all',});Policies update at runtime without restarting the sandbox, so a session can install packages first and restrict the network before its first unattended tool call. A connected Claude Code session needs a default-deny custom policy that allows its required model and authentication endpoints, or model calls routed through an external broker. Use deny-all for workloads that need no outbound access.
Copy link to headingKeep API keys out of the sandbox with credentials brokering
With the flag enabled, the agent can read accessible keys stored inside the sandbox and may send them to permitted network destinations. With credentials brokering, the firewall adds or replaces the authentication header on requests to a domain you configure. The brokered secret never enters the microVM and only travels to that destination, although the agent can still use the permissions it grants. The firewall terminates TLS for those domains with a certificate authority (CA) unique to each sandbox, so clients that ship their own CA bundle need to trust it.
Vercel's Claude Code support in durable-harness, currently experimental, applies the same separation to model calls. They go through AI Gateway with the deployment's OpenID Connect (OIDC) token, so no Anthropic API key is needed. AI Gateway also handles Claude Code model routing when you run Claude Code locally through its compatibility endpoint.
Copy link to headingReview agent edits as Git patches with the Herdr plugin
If a bypass session edits your checkout directly, you review the changes after it modifies the local files. The Herdr Sandbox plugin runs each terminal coding agent, including Claude Code, in its own persistent sandbox. Before the first upload, it prints the full eligible-file manifest for approval and filters out .git, environment-secret files, and recognizable credential files or contents, subject to configured overrides.
Each apply exports only the changes since the last one as a Git patch and checks it with git apply --check before touching your worktree. The plugin runs on macOS and Linux, and its example one-hour timeout requires a Vercel Pro or Enterprise plan.
Copy link to headingRequire a session budget before an agent route goes public with durable-harness
Anyone authorized to use an HTTP route that starts bypass sessions can start one. Without authentication, that can mean anyone who reaches the route. In durable-harness, production chat route safeguards refuse every request with a 401 until you configure authorize, and a public route with authorize: 'public' also requires allowPublicSandbox: true and a finite sandbox({ budget: { sessionUsd } }).
The route throws at creation when either setting is missing. This public Sandbox-backed chat route requires a per-session budget. For Claude Code, sessionUsd caps model spend. The same budget option also takes vmSeconds to cap Sandbox time and turnUsd to cap spend per turn. A per-session budget does not limit how many sessions callers can start, so a public service also needs limits on aggregate usage.
Skipping permissions is a reasonable tradeoff once the boundary, egress policy, and credential layer are configured. Auto mode or a CI allow list handles sessions that don't need to be bypassed. The choice depends on your team's repositories, credentials, and risk tolerance. Each layer reduces risk without guaranteeing safety for anything the agent can still reach.
Start a new project to run Claude Code inside a sandbox, or browse templates for a coding agent starting point.
Copy link to headingFrequently asked questions about Claude Code dangerously skip permissions
Copy link to headingIs Claude Code dangerously skip permissions safe?
Not on its own. Claude Code's docs warn that bypass mode offers no protection against prompt injection, so instructions hidden in a file or web page the agent reads can influence tool calls before anyone reviews them. Running it in a sandbox with scoped credentials and restricted egress limits what those tool calls can reach.
Copy link to headingHow do you enable dangerously skip permissions in Claude Code?
With the --dangerously-skip-permissions startup flag. The first interactive run shows a warning. Accepting it records that choice in ~/.claude/settings.json. Declining exits Claude Code. --allow-dangerously-skip-permissions makes bypass available in the Shift+Tab cycle without starting in it. In interactive terminal sessions, making bypass available also removes plan mode's enforced tool blocks. Project settings can't make bypass the default in current versions.
Copy link to headingWhen should you not use dangerously skip permissions?
Whenever an administrator needs every session checked, such as on centrally managed machines. Administrators can block bypass mode with permissions.disableBypassPermissionsMode in managed settings, and cloud sessions ignore a bypass default set in settings files. Older versions let a subagent definition run in bypass mode despite that policy, so keep Claude Code updated.
Copy link to headingDoes a sandbox change what reaches Claude Code's model?
No. Your prompts and the files Claude reads still go to the Anthropic API or your configured provider, with or without a sandbox. Isolation limits where tools run and what they can reach, not what Claude includes in its requests to the model.