Practice
Full permissions, without wrecking your machine
Approval prompts are what make an agent useless when you're away, and turning them off on your laptop is how people lose an afternoon. The fix isn't bravery. It's putting the agent somewhere you wouldn't mind rebuilding.
Quick answer
--dangerously-skip-permissions runs every tool call without asking. Anthropic says to use it only in isolated containers or VMs, and Claude Code refuses it as root. Run it as a non-root user on a disposable server or container with no production secrets. Or use auto mode, where a classifier approves safe actions. Anthropic's mobile app can't switch a session into bypass.
Claude Code asks before it does anything consequential. At a desk that's fine: you glance, approve and carry on. Away from the desk it stalls the work. The agent stops at step three of a twenty-minute task and waits for a tap that comes forty minutes later, when the whole point of handing it off was that you weren't watching.
So people reach for --dangerously-skip-permissions. That flag is dangerous on the wrong machine and reasonable on the right one, and the difference isn't how careful you are. It's what the agent can reach when it does something you didn't intend. This page covers what the flag really does, why it won't run as root, the setup that makes it defensible, and the equivalents in Codex, OpenCode, Grok Build and Antigravity.
What bypass actually allows
Claude Code has six permission modes. Anthropic's permission modes page describes them like this. The table follows the docs' order: default is the config name for Manual mode, not the mode a session starts in.
| Mode | Runs without asking | Anthropic's "best for" |
|---|---|---|
default (Manual) | Reads only | Sensitive work |
acceptEdits | Reads, file edits, common filesystem commands | Iterating on code you're reviewing |
plan | Reads, plus classifier-approved commands when auto mode is available | Exploring before changing |
auto | Everything, with background safety checks | Long tasks, fewer prompts |
dontAsk | Reads and pre-approved tools; everything else is denied | Locked-down CI |
bypassPermissions | Everything | Isolated containers and VMs only |
Bypass runs every tool call immediately, including writes to protected paths such as .git and Claude's own config. A few things still hold:
- Deny rules in your settings block in every mode, bypass included. Allow rules have no effect in it.
- Explicit ask rules still prompt.
rmandrmdiraimed at critical paths still prompt: the filesystem root, top-level directories, your home directory, and the working directory and its parents.
What bypass doesn't give you is any defence against prompt injection or a confidently wrong command. Anthropic's docs say it plainly: use it only in isolated environments where Claude Code can't damage your host.
As of Claude Code v2.1.283, auto mode is the built-in starting mode for interactive terminal and VS Code sessions. A second model reviews each action and blocks risky ones, such as mass deletion on cloud storage, force pushes, or launching another agent loop with approvals and sandboxing turned off. It removes most prompts without removing every check. It needs a supported model, and an organization can turn it off. If auto mode is enough for your task, you may not need bypass at all.
Two flags that look alike
--dangerously-skip-permissionsstarts the session in bypass. It's equivalent to--permission-mode bypassPermissions.--allow-dangerously-skip-permissionsonly adds bypass to the Shift+Tab cycle. The session starts in a normal mode, and you switch into bypass when you choose.
The second one matters because you can't enter bypass from a session that wasn't started with it enabled. If you might want it later, you have to decide at launch. The --allow- form is the careful way to do that: the session behaves normally until you deliberately switch.
The first interactive launch with bypass enabled shows a warning dialog. Accepting it writes skipDangerousModePermissionPrompt: true to ~/.claude/settings.json; declining makes Claude Code exit. Non-interactive runs with -p skip the dialog. Administrators can block the mode for everyone with permissions.disableBypassPermissionsMode: "disable" in managed settings.
Why it fails as root
On Linux and macOS, Claude Code refuses to start in bypass mode as root or under sudo:
--dangerously-skip-permissions cannot be used with root/sudo privileges for security reasonsThe check is skipped inside a sandbox Claude Code recognises, and Anthropic's dev container runs it as a non-root user for that reason. On a plain VPS where you log in as root, create a normal user first. Our VPS setup guide has the three commands.
We learned three practical things running Claude Code under Maude's daemon on many different servers:
- As root, the
--allow-form failed too. In our tests with Claude Code 2.1.x, the process exited at spawn rather than just leaving bypass out of the cycle. Any wrapper that adds the flag needs to check the user ID first, or every session on a root server dies. - Old versions reject the flag outright. A CLI that doesn't know the flag exits the same way. Check that it appears in
claude --helpbefore passing it. - Test on a fresh machine. Your own
~/.claude/settings.jsonprobably already hasskipDangerousModePermissionPromptfrom the day you clicked through the warning. On a fresh server, that dialog appears before the prompt and an unattended session sits waiting at it. Test in a clean container, not on your laptop.
The disposable server pattern
Before relaxing permissions anywhere, ask one question: if this process ran an arbitrary destructive command right now, what would I lose?
On a typical laptop the honest answer is uncomfortable: your SSH keys, cloud credentials in ~/.aws and ~/.config, browser profiles with live sessions, a .env with production URLs, and every other repository you have checked out. On a disposable VPS with one project on it, the answer is that project, which is pushed anyway, plus an hour of rebuild time. That's a risk you can accept. Here are three places to put the agent:
A container on your own machine
This is the cheapest and closest option. Run a Linux container with Docker or OrbStack, install Claude Code inside as a non-root user, and mount only the project you want it to touch. Don't mount your home directory, don't pass host credentials in, and don't use --privileged or mount the Docker socket, because both hand the host back.
A dedicated VPS
This is the option most people settle on: a small box running one or two projects and nothing else. It's always on, so work continues while your own machines are off. If it's ever compromised, you destroy it and build another. Keep it boring to rebuild, with a short setup script rather than a machine you've hand-tuned for a year. The VPS buyer's guide covers sizing.
An ephemeral cloud sandbox
Anthropic's cloud sessions run each task in an isolated VM, with git credentials kept outside the sandbox and network access limited by default. That's strong isolation with nothing to maintain. But bypass isn't available there. Cloud sessions offer Accept edits, Plan and Auto, and ignore bypassPermissions set in a repository's settings.
Secrets to keep off the box
- Production credentials. Point it at staging or a local copy. The failure you're guarding against isn't malice; it's a confident mistake against a connection string that happened to be lying around.
- Your personal SSH key. Give the server its own deploy key or a fine-grained token, scoped to the repositories it needs. Don't use SSH agent forwarding into it either: that lends the box your keys for as long as you're connected.
- Broad cloud tokens. No admin AWS keys or org-wide GitHub tokens. If a task needs one, scope it and let it expire.
- Anything that exists only there. Push often, so losing the server costs you nothing you can't recreate.
One credential has to live on the box: the agent's own login. Claude Code keeps it in ~/.claude/.credentials.json, so anyone with a shell as that user can use your plan. That's one more reason to give the agent a user of its own.
Equivalents in Codex and other agents
Every coding agent has its own version of this switch, and they don't all mean the same thing:
| Agent | Skip all prompts | Safer middle ground |
|---|---|---|
| Claude Code | --dangerously-skip-permissions (refused as root) | Auto mode; acceptEdits; deny rules |
| Codex | --dangerously-bypass-approvals-and-sandbox, alias --yolo: "Only use inside an externally hardened environment" | --sandbox workspace-write with on-request approvals (network off by default). --full-auto is now a deprecated alias for this |
| OpenCode | opencode --auto (deny rules still enforced) | allow / ask / deny per tool in opencode.json. Note that most tools default to allow |
| Grok Build | grok --always-approve (deny rules and PreToolUse hooks still apply) | Auto mode (a classifier approves safe tools); a separate sandbox limits approved calls |
| Antigravity CLI | agy --dangerously-skip-permissions | Allow, ask and deny lists (deny wins); the default preset sandboxes terminal commands without network on macOS and Linux |
Sources: Codex CLI reference and approvals and security, OpenCode permissions, Grok Build permissions, Antigravity permissions and Google's Antigravity CLI codelab, checked October 2026. Codex and Antigravity both sandbox by default, so turning off their prompts and their sandbox are separate decisions. Turning off the sandbox is the one that needs the disposable box.
Can I enable bypass from my phone?
Not from the Claude app. Anthropic's mobile docs say you can't select Bypass permissions from the app, for either cloud sessions or Remote Control, and Remote Control from the app doesn't offer Auto either. For a general-purpose client that's a sensible default.
Maude is built for the other case, a server you own and could rebuild, so it offers each agent's full-access mode as "yolo" next to the agent's other modes. For Claude, it only takes effect when the daemon runs as a non-root user and the installed Claude Code supports the flag. Otherwise the session stays in a normal mode. Maude starts the session in a normal mode and switches into bypass after launch, never at spawn. On a root-only server, a button in the app creates a non-root user for you. You can set a default mode for each agent, or change it per session.
Full permissions are a decision about where the agent runs, not a risk setting. Put Claude Code on a non-root user, on a box with nothing worth stealing and nothing you can't rebuild, and you can let it run unattended without worrying. Leave it on the machine that holds your keys and your client work, and no amount of care makes that a good trade.
Run it from your phone
If you've set up the disposable server, Claude Code on your phone shows how Maude runs it there. Approving agent permissions from your phone covers the opposite approach, keeping prompts on and answering them from a notification.
Frequently asked questions
Is --dangerously-skip-permissions safe?
Why does it fail as root?
--allow-dangerously-skip-permissions as root also made the process exit at spawn.What's the Codex equivalent?
codex --dangerously-bypass-approvals-and-sandbox, also spelled --yolo, which turns off both approvals and the sandbox. OpenAI says to use it only inside an externally hardened environment. The low-friction default is --sandbox workspace-write with on-request approvals. The older --full-auto is deprecated and prints a warning.Can I enable bypass from my phone?
What's the difference between the two skip-permissions flags?
--dangerously-skip-permissions starts the session in bypass mode. --allow-dangerously-skip-permissions starts it in a normal mode and only adds bypass to the Shift+Tab cycle, so you can switch into it later. You can't switch into bypass at all in a session started without one of them.What changed
- — Rewritten: root restriction, --allow-dangerously-skip-permissions vs --dangerously-skip-permissions, auto mode as the default middle ground, what bypass still blocks, Codex/OpenCode/Grok Build/Antigravity equivalents, and what Anthropic's mobile app and Maude allow.
- — First published.
