claude --dangerously-skip-permissions: what it removes

claude --dangerously-skip-permissions starts Claude Code in bypassPermissions mode, the one people call YOLO mode. Almost every tool call runs the moment the model makes it: no permission prompt, no protected-path check, nothing in their place. Anthropic’s docs say to use it only inside an isolated container or VM. Hooks are not a dependable net there either: the docs say a hook’s deny still blocks, but a public bug report describes a command finishing before the deny arrived. For fewer prompts, run auto mode, or Manual mode with the sandbox, and add deterministic rules.

What --dangerously-skip-permissions removes

The flag is equivalent to --permission-mode bypassPermissions. In Anthropic’s words, the mode “disables permission prompts and safety checks so tool calls execute immediately, including writes to protected paths.” Protected paths are the files Claude Code otherwise never auto-approves: .git, .claude, .husky, shell profiles such as .bashrc and .zshrc, .npmrc, .mcp.json and more. Under this flag those writes go straight through.

A few checks survive. It is worth knowing exactly which ones, because they are all you have left:

The bottom line on that receipt is a quote. The sandboxing docs list what replaces the permission prompt under this flag: “Nothing.” The permission-mode docs add that bypass mode “offers no protection against prompt injection or unintended actions.” Anthropic’s auto mode announcement is blunter still: skipping permissions “can result in dangerous and destructive outcomes and should not be used outside of isolated environments.”

Why hooks are not a safety net in bypass mode

A PreToolUse hook is a program Claude Code runs before each tool call. It can answer “deny”, and the call doesn’t happen. Anthropic’s hooks guide says these hooks fire before any permission-mode check and that a deny “blocks the tool even in bypassPermissions mode or with --dangerously-skip-permissions.”

A public bug report says it didn’t. In anthropics/claude-code#20946, “PreToolUse hooks don’t block command execution in bypass mode” (opened January 2026), a hook returned exit code 2 to block a git commit. The denial arrived 37 seconds after the command was issued; the commit already existed. The issue was closed as not planned. It is one report, and we have not reproduced it on the current release. But “the docs say it holds” is not the same as “we checked”, and a guardrail you can’t verify is a guess.

So Bulkhead does not support bypass mode. If you run it there, its hooks still install and still try; we just won’t tell you they hold. The same goes for any hook-based guard, including the ones in our Claude Code hooks guide.

Every mode, and what decides each call

What to run instead

Pick by how much you’ll be watching. Each setup below gives the prompt’s job to something (a classifier, an operating-system boundary, a rule) instead of to nothing.

1. At your desk, fewer prompts: auto mode

A separate classifier model reviews each action before it runs and, by default, blocks things like curl | bash, production deploys, mass deletion on cloud storage and force pushes. Anthropic’s own framing: auto mode “reduces risk compared to --dangerously-skip-permissions but doesn’t eliminate it entirely.” Our auto mode guide covers where a classifier and a fixed rule disagree.

claude --permission-mode auto

2. At your desk, no classifier: Manual mode plus the sandbox

Run /sandbox and pick auto-allow. Shell commands that stay inside the sandbox’s filesystem and network limits run without a prompt, and the operating system enforces the boundary. Deny rules still apply and a critical-path rm still prompts. The Bash sandbox covers shell commands only; Claude Code’s file tools, MCP servers and hooks still run on your host.

claude --permission-mode default
# then, inside the session:
/sandbox

3. Unattended: a real boundary first

For overnight or CI runs, put the whole Claude Code process inside a boundary: Anthropic’s dev container (with its default-deny firewall), your own container, a VM, Docker Sandboxes, or the @anthropic-ai/sandbox-runtime wrapper, run as a non-root user. Anthropic’s sandbox environment docs call that boundary required for bypass mode. If you do skip permissions inside the box, the box is your control, not your hooks. We would still run auto mode in there, so each action keeps a reviewer and the rule layer below keeps working.

claude -p "port the billing tests to vitest" --permission-mode auto

Then put a floor under all three

Whichever mode you pick, the lines that must hold the same way every time belong in code, not in a model’s judgment or in CLAUDE.md. That is what Bulkhead is: PreToolUse, PostToolUse and Stop hooks plus a bulkhead.yaml you own. It denies dangerous commands such as terraform destroy, an unscoped DELETE or a force-push to main, sends the agent back to work when it says “all tests pass” after a failed run, pauses at a dollar cap, and keeps a hash-chained receipt of the session. It works in Manual, acceptEdits and auto mode; add --preset strict for unattended runs.

dangerous calls denied in the open corpus

26/26

more denied with --preset strict

+6

known misses, listed on purpose

5

default session cap ($20 a day)

$5

npx @bulkheadtools/cli init

What it doesn’t do: it is not a sandbox, it can’t see inside python3 -c or a script the agent wrote a minute earlier, and it doesn’t stop prompt injection. The proof shows the 5 known misses next to the denials, and sandbox vs guardrails covers how the two layers fit.

Questions