Guide

Is it safe to run Claude Code with --dangerously-skip-permissions?

Updated November 6, 2026

Short answer

Not on a laptop with real credentials. The flag turns off Claude Code's permission prompts and safety checks, so tool calls run as soon as the agent proposes them, and Anthropic's docs say to use it only in isolated containers or VMs without internet access. Clicking allow on every prompt isn't safe either: in Anthropic's 1,053-tester study, humans caught only 13.6% of dangerous commands. The safer setup is a check on each action at the pre-execution hook, outside the agent, so you don't need prompts.

What the flag actually turns off#

--dangerously-skip-permissions puts Claude Code in bypassPermissions mode. Anthropic's permission modes docs say this mode "disables permission prompts and safety checks so tool calls execute immediately, including writes to protected paths."

The docs also say the mode "offers no protection against prompt injection or unintended actions." Whatever the agent proposes runs, including anything a poisoned README or web page talks it into.

Where the flag is reasonable#

Anthropic's own guidance is to use it "only in isolated environments like containers, VMs, or dev containers without internet access." Use that as a checklist:

A throwaway container or VM, not your laptop.
No real secrets mounted: no cloud credentials, no .env, no SSH keys.
No outbound network, or a tight egress allowlist.
Nothing in the environment you'd mind losing.

If all four hold, the flag is reasonable, because the blast radius is the container. A laptop with your AWS profile, your GitHub token and your browser sessions fails all four.

Why "just click allow" isn't the answer#

People use the flag because the alternative is miserable. Anthropic reports that 25% of interactive sessions start in bypass permissions mode.

Prompts don't hold up as a control either. Anthropic's engineers report that users accept 93% of manual permission prompts anyway, and they call the result approval fatigue.

Their controlled study puts a number on it. Anthropic hired 1,053 paid testers, and they caught the dangerous command just 13.6% of the time (143 of 1,053).

The volume makes it worse. Agents average 145 actions per session, and long sessions pass 1,000. Nobody reads 145 prompts carefully, so the real control was the developer's patience, and that runs out.

What the built-in options cover#

Permission rules and deny lists. Good for commands you can name in advance. They match the patterns you wrote, so the same action phrased differently can slip past. More on that in stopping agents from running destructive commands.
Managed settings. Admins can block the flag across the fleet by setting permissions.disableBypassPermissionsMode to "disable", per the docs. That takes the flag away. It doesn't judge what the agent does in the modes that are left.
Containers and VMs. The strongest limit on blast radius. They can't tell you whether a command inside them was the one you wanted.
Auto mode. Anthropic's classifier-based mode blocked 89% of the same commands in that study. It's a real improvement, and it only covers Claude Code.
Scoped credentials. Still the best single control. If the token can't delete production, the agent can't either.

A decision rule#

Disposable environment, no secrets, no network: the flag is reasonable.
Real credentials on the machine: don't use the flag, and disable it in managed settings.
Real credentials and you want unattended runs: put a check at the pre-execution hook so no prompt is needed.
Always: scope tokens, keep production credentials off developer laptops, and record what agents run.

If you're approving Claude Code for a team, the security review checklist covers the rest.

Where Harden fits#

Harden Agentic Integrity Foundation (AIF) is built for the third case. It runs on the developer laptop, outside the agent, at the agent's pre-execution hook, and checks every command, file edit and push against the session's intent before it runs.

Decisions are made locally in about 28 ms (P99 about 70 ms), so nothing waits on a person and nothing leaves the machine. A dangerous action gets blocked or rewritten, and the agent gets the reason so it can retry safely. If the check can't run, the action doesn't run.

AIF starts watch-only, so you can see what your agents do before you enforce anything. One policy covers every agent that exposes a pre-execution hook.

It's a layer, not a perimeter. It doesn't replace least privilege, scoped credentials or egress policy, and it can't contain a process that's already malicious. For the security team's view, see Harden for security teams.

FAQ