Claude Code YOLO mode (--dangerously-skip-permissions): what it does and safer options

Updated 24 October 2026

--dangerously-skip-permissions turns off Claude Code’s permission prompts for the whole session. Claude edits files, runs shell commands and makes network requests without asking you. People call it “YOLO mode”, but that’s a community nickname, not an official name: the docs call it bypassPermissions mode. Anthropic’s own advice is to use it only inside a container or VM. This page covers exactly what the flag skips, the few things it doesn’t, what can go wrong, and the options that get you most of the speed with far less risk.

The short answer

1. What the flag actually does

The flag starts the session in the bypassPermissions permission mode. These two commands are equivalent:

Terminalclaude --dangerously-skip-permissions
claude --permission-mode bypassPermissions

In that mode:

• Every tool call runs as soon as Claude makes it: file edits, Bash commands, web fetches, MCP tools, subagents.
• Writes to protected paths are allowed. Normally Claude Code always asks before touching .git, .claude, .vscode, .husky, .devcontainer, shell startup files such as .bashrc and .zshrc, .gitconfig, .npmrc, .mcp.json and a few others. In bypass mode it doesn’t.
• Your permissions.allow rules stop mattering, because everything is already allowed.
• In an interactive terminal session, plan mode loses its teeth. Claude is still told to plan without editing, but if it tries an edit or a command while planning, it runs. This applies whenever bypass is available in the session, including when you started with --allow-dangerously-skip-permissions.

2. What still stops it

Bypass mode isn’t quite “everything”. Claude Code still holds back on these, in any mode:

• Deny rules. A permissions.deny rule blocks the call in every mode, bypass included.
• Explicit ask rules. A permissions.ask rule such as Bash(git push *) still shows a prompt.
• Questions. The AskUserQuestion tool and MCP tools marked as needing user interaction still wait for you.
• Critical-path removals. An rm or rmdir that Claude Code recognizes as targeting the filesystem root, a top-level directory like /usr, your home directory, or your working directory and its parents. In the terminal this prompt has a two-minute countdown; if you don’t answer, the command is denied and Claude is told to do something else.
• Reads outside the working directory, if you turned on permissions.blockReadsOutsideWorkingDirectories.

In a non-interactive claude -p run there’s nobody to answer, so those calls are denied instead of prompting.

Two catches. Bash deny and ask rules match the command text Claude writes, not the program it runs: Bash(git push *) stops git push origin main but not git -C . push origin main. And the critical-path check only covers rm and rmdir commands it recognizes. /bin/rm, find -delete or a script that deletes things gets no special treatment. Treat these as speed bumps, not walls.

3. How to turn on YOLO mode: the command, VS Code and mid session

Things that trip people up:

• You can’t switch into bypass mode mid session unless the session started with one of the options above. --allow-dangerously-skip-permissions is the one to use if you want it there for later: it adds bypass mode to the Shift+Tab cycle without turning it on. Otherwise, restart.
• The setting only works from user, managed or --settings files. Since v2.1.257, bypassPermissions in a project’s .claude/settings.json or .claude/settings.local.json is ignored and the session starts in Manual mode, so a cloned repository can’t turn it on for you.
• The first interactive launch shows a warning you have to accept. Accepting writes "skipDangerousModePermissionPrompt": true to ~/.claude/settings.json. Delete that key to see the warning again. Declining exits.
• Background sessions (claude --bg) refuse bypass until that acceptance is in user or managed settings. If you see “Bypass permissions was requested at launch and ignored”, add the key to ~/.claude/settings.json and start a new background session.
• --restricted sessions refuse bypass mode, and cloud sessions on claude.ai don’t offer it at all.

4. “cannot be used with root/sudo privileges”

On Linux and macOS, Claude Code won’t start in bypass mode as root or under sudo:

Terminal--dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons

This mostly bites in Docker, where containers run as root unless you say otherwise. The fix is to run Claude Code as a normal user inside the container: set USER in your Dockerfile, or remoteUser in devcontainer.json. The check is skipped automatically inside a sandbox Claude Code recognizes. Don’t work around it by giving the user passwordless sudo for everything; that hands the agent root by another route.

5. What can actually go wrong

The flag is named the way it is for a reason. Anthropic’s documentation says plainly that bypass mode “offers no protection against prompt injection or unintended actions”. The realistic failure modes:

• Deleting the wrong thing. rm -rf "$DIR"/* with an empty variable, a cleanup step aimed one directory too high, a git clean -fdx that takes your untracked work with it. The critical-path check catches some rm forms; it doesn’t catch git clean, git reset --hard or a build script that wipes a folder.
• Rewriting shared history. If the session has push credentials, a git push --force to the wrong branch goes out with nobody to stop it. Same for publishing a package, deploying, or running a migration against whatever database your environment variables point at.
• Prompt injection. Claude reads files, issues, web pages and command output as it works. Text in any of them can tell it to do something you never asked for, like “also run this setup script”. With prompts on, you see the odd command before it runs. With bypass on, it just runs.
• Leaking secrets. .env files, ~/.ssh, ~/.aws, tokens in your shell environment, and Claude Code’s own credentials under ~/.claude are all readable by the session. Any network access, even a single curl, is a way out. Anthropic’s dev container page warns that even inside a container, a malicious project can exfiltrate anything the container can read, including those credentials.
• Editing your setup. Protected paths aren’t protected in this mode, so Claude can change .zshrc, git hooks in .husky, .npmrc or its own settings in .claude, and those changes run later, outside the session.

None of this needs a malicious model. A wrong guess, run fast enough, does the same damage.

6. Run it in a dev container, Docker or a VM

The documented safe way to use the flag is to put the whole Claude Code process somewhere it can’t hurt your machine. The quickest route is the official Dev Container Feature:

.devcontainer/devcontainer.json{
  "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
  "features": {
    "ghcr.io/anthropics/devcontainer-features/claude-code:1.0": {}
  }
}

Rebuild the container (in VS Code: Dev Containers: Rebuild Container), open its terminal, run claude once to sign in, then start unattended runs from there:

Terminal (inside the container)claude -p "run the test suite and fix what fails" --dangerously-skip-permissions

Anthropic’s reference dev container goes further and is worth copying from. Its devcontainer.json runs as the non-root node user, keeps ~/.claude in a named volume with CLAUDE_CONFIG_DIR pointing at it so you stay signed in across rebuilds, and adds the NET_ADMIN and NET_RAW capabilities so init-firewall.sh can lock down outbound traffic. That script allows DNS, SSH, GitHub’s IP ranges, the npm registry, api.anthropic.com, Sentry, Statsig and the VS Code marketplace, and drops everything else.

What a container doesn’t protect:

• Your project. The workspace is bind-mounted, so every edit and deletion shows up on your host immediately. Commit or stash before a long run.
• Anything you mount in. Don’t mount ~/.ssh, ~/.aws or other host credentials. Use repository-scoped or short-lived tokens instead.
• Anything the network allows. The reference firewall allows all of GitHub, so a container holding a token with push access can still push. Without a firewall, the container can reach anything your machine can.

Docker without the dev container tooling works the same way as long as Claude Code runs as a non-root user and you control mounts and network. For code you don’t trust at all, Anthropic recommends a dedicated virtual machine. On a native Windows host, use a container or a VM.

7. Sandboxing on your own machine

Claude Code has a built-in Bash sandbox. Run /sandbox and pick a mode, or turn it on in settings:

~/.claude/settings.json{
  "sandbox": {
    "enabled": true
  }
}

Sandboxed commands can write only to the working directory, the per-user temp directory and directories you added, and reach only the network domains you allow. In auto-allow mode, sandboxed commands run without prompts. It uses Seatbelt on macOS and needs bubblewrap and socat on Linux and WSL2. It doesn’t run on native Windows; there, commands run unsandboxed.

The limit: it only wraps shell commands. Claude’s own Read, Edit and WebFetch tools, MCP servers and hooks run outside it, on your host. So the Bash sandbox on its own isn’t enough for an unattended bypass session. To put the whole process behind one boundary without Docker, Anthropic publishes @anthropic-ai/sandbox-runtime, a beta that wraps Claude Code in the same Seatbelt or bubblewrap isolation.

8. Safer ways to get fewer prompts

Most people reach for the flag because of prompt fatigue, not because they need zero oversight. These cover most of that ground:

• Auto mode. claude --permission-mode auto, or Shift+Tab to it. A separate classifier model reviews shell commands, network requests and other risky actions before they run and blocks ones that go beyond what you asked for, or that look driven by something Claude read. On v2.1.283 and later it’s the default starting mode in the terminal and VS Code. It needs a supported model, and your organization can turn it off.
• acceptEdits. claude --permission-mode acceptEdits lets Claude create and edit files in your working directory, plus mkdir, touch, rm, rmdir, mv, cp and sed there, without asking. Other commands still prompt. Review the result with git diff.
• An allow list. Pre-approve the commands you run all day and block the ones you never want:

~/.claude/settings.json{
  "permissions": {
    "allow": [
      "Bash(npm run *)",
      "Bash(npm test *)",
      "Bash(git status)",
      "Bash(git diff *)",
      "Bash(git commit *)"
    ],
    "ask": [
      "Bash(git push *)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)"
    ]
  }
}

Put the * after the subcommand: Bash(git *) would allow every git command, push and reset included. Rules are checked deny first, then ask, then allow. The ask and deny entries also apply in bypass mode, so keep them even if you do use the flag.

• dontAsk for CI. claude -p "run the test suite" --permission-mode dontAsk --allowedTools "Bash(npm test)" "Read" runs what you listed, plus reads and other actions that never need approval, and denies anything that would prompt instead of waiting for input.

9. Block it for a team

Administrators can turn bypass mode off entirely with one key:

managed-settings.json{
  "permissions": {
    "disableBypassPermissionsMode": "disable"
  }
}

With it set, Claude Code rejects --dangerously-skip-permissions and ignores permissionMode: bypassPermissions in subagent definitions, which then run in the parent session’s mode. Put the file in the system directory for each OS:

The same key also works through MDM (the com.anthropic.claudecode preferences domain on macOS, HKLM\SOFTWARE\Policies\ClaudeCode on Windows) or server-managed settings from the claude.ai admin console. Run /status on one machine to confirm the managed source shows up. A file copied in by a repository’s Dockerfile can be edited by anyone with write access to that repository, so use MDM or server-managed settings for a rule people can’t remove. To do the same for auto mode, the key is permissions.disableAutoMode.

The key isn’t limited to managed settings. Put it in your own ~/.claude/settings.json if you want to make sure you never start a bypass session on your laptop by habit.

Answer prompts from your browser instead

If you’re skipping permissions because the prompts keep you stuck in a terminal tab, the other fix is to make answering them cheaper. Agent Pets uses Claude Code’s permission hook to show each prompt on whatever Chrome page you’re on:

• Each Claude Code, Codex, OpenCode and omp session becomes a pet that walks along the bottom of every page. When one needs permission, its pet bounces; click it and answer Allow, Always or Deny.
• A capsule over each pet shows its state, such as Thinking, Your Turn, Allow Bash? or Done, and the toolbar badge counts the sessions waiting on you.
• In another app, a desktop notification names the pet that needs you, with Allow and Deny on it.

You still see every command before it runs. npx getagentpets init adds the hooks next to any you already have, it runs entirely on your computer, and the terminal prompt keeps working as usual.

Get Agent Pets — was $25, now $6$25 $6Get Agent Pets — $25

Questions

What does --dangerously-skip-permissions do in Claude Code?

It starts the session in bypassPermissions mode, so tool calls run without asking you. Deny rules, explicit ask rules, the AskUserQuestion tool and recognized rm or rmdir commands aimed at critical paths, such as your home directory, still stop it.

Why does Claude Code say it cannot be used with root/sudo privileges?

On Linux and macOS, Claude Code refuses to start in bypassPermissions mode as root or under sudo. Run it as a normal user, for example in a dev container whose remoteUser isn’t root. The check is skipped inside a recognized sandbox.

How do I stop my team from using --dangerously-skip-permissions?

Set permissions.disableBypassPermissionsMode to "disable" in managed settings. Claude Code then rejects the flag and ignores permissionMode: bypassPermissions in subagent definitions.

Can I make bypassPermissions the default mode?

Yes, with "defaultMode": "bypassPermissions" under permissions in ~/.claude/settings.json. Since Claude Code v2.1.257 the value has no effect in a project’s .claude/settings.json or .claude/settings.local.json, and the session starts in Manual mode instead.

Is auto mode safer than --dangerously-skip-permissions?

Yes. In auto mode a classifier reviews actions such as shell commands and network requests before they run, and blocks ones that go beyond your request. bypassPermissions has no such check. Neither one is a sandbox, so unattended runs still belong in a container or VM.

What is YOLO mode in Claude Code?

It’s the community nickname for bypassPermissions mode, which you start with claude --dangerously-skip-permissions. Anthropic doesn’t use the name. The yolo mode command is just that flag; there’s no separate --yolo option in Claude Code.

Can I turn on dangerously skip permissions mid session?

Only if the session started with bypass mode available. Start with claude --allow-dangerously-skip-permissions and press Shift+Tab when you want it; bypass mode then shows up in the cycle after plan mode. A session started without any of the bypass options can’t switch into it, so restart.

How do I use YOLO mode in VS Code?

Turn on claudeCode.allowDangerouslySkipPermissions in the extension settings, then choose Bypass permissions from the mode indicator. Setting claudeCode.initialPermissionMode to bypassPermissions in your user settings starts new conversations in it.

Sources: Claude Code’s documentation on permission modes, permissions, settings, managed settings, dev containers, sandbox environments, sandboxing and security; Anthropic’s reference dev container; claude --help for Claude Code 2.1.287.

More guides

• Claude Code permissions explained
• How to stop Claude Code asking for permission: allow all commands safely
• Claude Code settings.json: file locations and reference
• Claude Code hooks: a practical guide
• Claude Code notifications: when done or waiting for input