Should you use --dangerously-skip-permissions in Claude Code?

Starting Claude Code with claude --dangerously-skip-permissions is the same as claude --permission-mode bypassPermissions. In Anthropic's words, this mode "disables permission prompts and safety checks so tool calls execute immediately, including writes to protected paths" such as .git and .claude (Claude Code docs). Allow rules have no effect in this mode, because everything is already allowed.

Some things still stop it. Deny rules block in every mode. Explicit ask rules still prompt. A recognized rm or rmdir of a critical path, such as the filesystem root, your home folder or your working folder, still prompts. The docs warn that this check "can miss some commands", so it does not replace an operating-system boundary (Claude Code docs).

The first time you start it, Claude Code asks you to accept responsibility, then remembers your answer. On Linux and macOS it refuses to run as root or under sudo. The docs give one place for it: "Only use this mode in isolated environments like containers, VMs, or dev containers without internet access, where Claude Code cannot damage your host system." And a second warning: it "offers no protection against prompt injection or unintended actions" (Claude Code docs).

Because the prompts stop meaning much. Anthropic's own data: "in practice users accept 93% of them anyway." Over time that leads to approval fatigue, "where people stop paying close attention to what they're approving" (Anthropic Engineering).

Developers say the same thing in their own words. "Type 'continue'. Approve a bash command I didn't read" (364 upvotes, r/ClaudeAI). "My company job now is just pressing enter endlessly" (1,720 upvotes, r/ClaudeAI). Under a meme about the flag, one reply: "The flag says 'dangerously' but my deadlines say 'necessarily'" (r/ClaudeCode).

And it works. Simon Willison, who calls it YOLO mode, wrote that "you can leave Claude alone to solve all manner of hairy problems" and got useful work done in parallel. He also wrote, on the same page: "The only solution that's credible is to run coding agents in a sandbox" (Simon Willison).

Deleted files. On 7 November 2026 a developer wrote that Claude Code had wiped their Mac's ~/Library: app data, saved passwords, settings. It was cleaning up test folders under Application Support; the space in that name split the path, and rm -rf ran on ~/Library instead. "I wasn't even at my Mac when this happened." The top reply, with 1,230 upvotes, quoted the author: "yes, I was running with --dangerously-skip-permissions" (3,680 upvotes, r/ClaudeCode). In December 2025, another post showed rm -rf tests/ patches/ plan/ ~/, with a home folder at the end (1,924 upvotes, r/ClaudeAI).

Actions you did not mean. Anthropic keeps a log of what agents did when they went past what the person asked: deleting remote git branches after "clean up old branches", searching config files for other API tokens after an auth error, and attempting migrations against a production database (Anthropic Engineering).

Instructions hidden in what it reads. An agent that reads web pages, issues or files can be steered by text in them. Willison calls this "an incredibly common vulnerability" (Simon Willison). With every prompt gone, nothing stops the steered command from running.

Some people accept the risk on purpose. One developer runs it on a gaming and build machine, lost the C: drive, and wrote: "nothing of value was lost" (485 upvotes, r/ClaudeCode). That is the container advice in another form: a machine you can lose.

What developers and Anthropic's docs suggest, depending on what you want.

• Fewer prompts on your own machine: auto mode. A separate classifier checks actions before they run and blocks what goes beyond your request. Anthropic calls it "a safer way to skip permissions" and is open about its limits: in their test it missed 17% of real overeager actions (Anthropic Engineering). Start it with claude --permission-mode auto.
• Fewer shell prompts: the Bash sandbox. Run /sandbox and choose auto-allow. Commands run without asking, and the operating system limits which files and networks they reach (Claude Code docs).
• Fully unattended runs: a container. Anthropic's dev container runs Claude Code as a non-root user, and its reference version adds a firewall that limits outbound traffic. Claude can still change any file in the mounted project folder, and the docs say not to mount host secrets such as ~/.ssh into it (Claude Code docs).
• Keep the calls that matter yours, in any mode. Deny rules block even in bypass mode, and ask rules still prompt. A rule like Bash(git push *) set to ask keeps that one decision with you while everything routine runs (Claude Code docs).

Whichever mode you pick, the question underneath is the same: which decisions do you still make, and are they the ones that matter? A pull request that "changes 60 files" and gets "LGTM" two minutes later (2,216 upvotes, r/softwareengineer) is the same question in code review.

We made a free tool that counts it. Who said yes? reads the Claude Code and Codex logs on your computer and counts how many of your agent's actions you approved yourself, at the prompt, and what answered the rest: a saved rule, the permission mode, auto mode, settings or a hook. It asks you to guess first. Run npx github:skprasad-korture/who-said-yes. It has no network code and needs no account.

What it found for one of us. On 9 November 2026, SK's Claude Code logs from 8 October to 9 November held 17,595 agent actions across 100 sessions. He said yes himself 36 times, about 1 in every 489 actions. 822 of his 828 file edits ran with no prompt shown to him. Everything else was answered for him: the permission mode he had set (6,147), auto mode (9,415), settings (1,739), rules he saved earlier (129) and hooks (21). SK is not a developer. He builds with agents and wanted to know who was making the calls.

A count is not a verdict. A low number can mean good rules or no reading at all. Only you know which.

How KORTURE.ai measures this: Sense reads your own chats on your computer, and shows the moments behind each reading in your own words, such as when you let a run keep going and when you stopped to check.