Claude Code --dangerously-skip-permissions: Safe or Not?
Is --dangerously-skip-permissions safe? Not on your main computer. Anthropic says use it only in a container or VM. Here's what it skips and what to use.
Is Claude Code’s --dangerously-skip-permissions flag safe? Not on the computer you use every day. Anthropic’s own docs say to use it only in an isolated container or virtual machine, ideally with no internet access.
That’s the short answer. The honest answer starts with the case for the flag, because it’s a good one.
Why do people want this flag at all?
Because permission prompts slow you down on long jobs. In Manual mode, Claude Code stops to ask before it edits a file or runs a command. On a long build that can mean dozens of interruptions. You stop reading them and just press yes.
That’s the strongest argument for skipping them. If you approve everything without reading, the prompts aren’t protecting you anyway.
The flag also works. Claude Code finishes long jobs without you sitting there. You come back to finished work instead of a question waiting on screen.
All of that is true, and it still isn’t the full picture.
What does the flag actually do?
It starts Claude Code in a mode called bypassPermissions. These two commands are the same:
claude --dangerously-skip-permissions
claude --permission-mode bypassPermissions
In that mode, almost everything runs without asking. File edits, shell commands, network requests. The first time you use it, Claude Code shows a warning and asks you to accept responsibility. If you decline, Claude Code exits.
What’s the real risk?
The docs say bypass mode “offers no protection against prompt injection or unintended actions.”
Prompt injection means instructions hidden in something Claude reads. A web page. A downloaded file. A comment in someone else’s code. In normal modes, a bad command still has to get past you or a safety check. In bypass mode, nothing stands in the way.
Unintended actions are simpler. Claude misreads the job and deletes the wrong folder, or rewrites files you wanted kept. Your project’s .git folder and your shell settings files are protected in the other modes. In bypass mode, writes to them are allowed.
Git can undo changes inside your project. It can’t undo a command that reached outside it.
What still protects you in bypass mode?
Less than people think, but not nothing:
| Still applies | What it means |
|---|---|
| Deny rules | Anything you’ve explicitly blocked stays blocked. |
| Ask rules | Tools you’ve marked “always ask” still prompt. |
| Dangerous deletes | Removing critical paths still prompts, unless you turn that off. |
| Root and sudo | On Mac and Linux, it refuses to start as root outside a recognized sandbox. |
Everything else runs, and your allow rules stop mattering because everything is already allowed.
So when is it safe?
When Claude Code can’t damage anything you care about. That’s Anthropic’s line, not mine.
In practice that means a container, a virtual machine or a dev container, with no internet if you can manage it. Anthropic publishes a dev container setup for exactly this job. It runs Claude Code as a non-root user.
If you’re on your own laptop with your email, your client files and your passwords one folder away, don’t use it.
What should you use instead?
You have better options than all or nothing.
Auto mode. On current versions it’s the starting mode for interactive sessions. A separate safety model checks each action before it runs and blocks anything that goes beyond what you asked for. Anthropic says it cuts prompts but doesn’t guarantee safety.
Accept edits mode. File edits and simple file commands run without asking. Anything else still prompts.
Allow rules. Type /permissions and pre-approve the commands you run all day. You stop getting asked about the safe stuff only.
Press Shift+Tab in a session to cycle through the modes. If you want bypass available but not on at startup, the --allow-dangerously-skip-permissions flag adds it to that cycle without starting in it.
What about agent teams?
Teammates start with the lead’s permission mode. Start the lead with this flag and every teammate runs without prompts too. More agents, same missing guardrails. More on teams in Claude Code Agent Teams.
Frequently asked questions
Is —dangerously-skip-permissions the same as bypassPermissions?
Yes. The flag is equivalent to --permission-mode bypassPermissions. Both skip almost every permission prompt.
Can I use —dangerously-skip-permissions in VS Code or the desktop app? Only after you switch it on. VS Code needs the “Allow dangerously skip permissions” setting, and the desktop app needs “Allow bypass permissions mode” on Pro and Max plans.
Is auto mode safer than skipping permissions? Yes. Auto mode has a safety model reviewing each action, and bypass mode has none. Anthropic still says auto mode doesn’t guarantee safety, so keep reviewing sensitive work.
Why won’t —dangerously-skip-permissions run with sudo? On Mac and Linux, Claude Code refuses to start this mode as root unless it detects a recognized sandbox. Running unchecked commands with full system access is the exact damage the mode can’t stop.
New to Claude Code? Start with What Is Claude Code?, or watch my free video, where I build a real site with it start to finish. Watch the free video.