Claude Code --dangerously-skip-permissions: how to use it safely

By Pulkit Batra · 29 October 2026 · 4 min read

Claude Code's --dangerously-skip-permissions flag, often called YOLO mode, stops it asking before it runs commands and edits files. It is the fastest way to work, and it is how a developer lost their home folder in December 2025. You don't have to choose between speed and safety. Here is what the flag turns off, what it doesn't, and how to keep it on without betting the machine.

What the flag does

By default Claude Code asks before it runs a shell command, edits a file or calls an MCP tool you haven't allowed. Start it with claude --dangerously-skip-permissions and it stops asking: the session runs in bypassPermissions mode and every tool call goes straight through. People use it for long refactors, overnight runs and anything where approving 200 prompts would take longer than the work.

The name is honest. With no prompts, the only thing between the model and rm -rf is the model's own judgement, and that judgement can be wrong or can be steered by text it read in an issue, a README or a web page.

What still runs with the flag on

Hooks are commands Claude Code runs at fixed points. A PreToolUse hook runs before every tool call, receives the tool name and its input as JSON, and answers. Claude Code passes it the current permission_mode, including bypassPermissions, and the hook can still return "permissionDecision": "deny". That makes hooks the right place for a safety net in YOLO mode: they don't depend on the prompts the flag removes.

# ~/.claude/settings.json: a PreToolUse hook on every tool
{
  "hooks": {
    "PreToolUse": [
      { "matcher": "*", "hooks": [{ "type": "command", "command": "squidbrake hook", "timeout": 600 }] }
    ]
  }
}

Check this on your own version before you rely on it: run a session with the flag, ask for a command your hook denies, and watch it get refused. squidbrake doctor does that check for you.

What goes wrong in YOLO mode

These are public incidents we replay in our benchmark, none with a rule written for the occasion:

Note the first row. A trailing ~/ on an otherwise reasonable cleanup command. No prompt-level instruction would reliably catch that; a parser that reads the command does.

Five ways to keep YOLO mode safe

1. Run it somewhere disposable. A dev container, a VM or a fresh clone with no production credentials. This is the strongest control and the one most people skip because it's inconvenient.
2. Keep credentials out of reach. The Railway incident started with a token sitting in the repo. Tokens the agent can read are tokens the agent can use.
3. Put a checkpoint in a PreToolUse hook. Let reads, searches, builds, tests and edits inside git run on their own. Hold what can't be taken back for a person: deletes outside git, destructive SQL, git push --force, terraform destroy, cloud API deletes, changes to the agent's own settings. Block the handful nobody should approve in the moment: deleting a home folder or a drive.
4. Keep an undo. Squidbrake copies files, and the git state, right before an approved delete, git reset or git clean runs, so squidbrake undo puts them back.
5. Look at the session, not just the step. Reading .env is fine. Reading .env and then curl-ing it to an address from a web page the agent fetched is not.

Doing it with Squidbrake

pipx install squidbrake
squidbrake connect claude-code     # adds the PreToolUse hook
claude --dangerously-skip-permissions

Routine work keeps flowing. When Claude Code reaches for something it can't take back, the call waits and a teammate sees what it will change ("deletes 4,312 rows of 10,240 in orders") on Slack, their phone or the dashboard. The rules are one YAML file; the check takes a few milliseconds and uses no LLM.

On a team: turn the flag off centrally

For a company, the better answer is often "nobody runs with the flag and nobody can remove the hook". Claude Code reads a managed settings file that users can't override. squidbrake lockdown --url https://gateway.yourcompany.com writes that file for Claude Code (and the equivalents for Codex, Gemini CLI and Cursor): Squidbrake's hook, only managed hooks allowed, and --dangerously-skip-permissions disabled. IT pushes it with the MDM you already use. See the docs for paths per OS.

FAQ

Related guides

• How an AI agent deleted a prod database and how to stop itReplit's agent wiped a production database during a code freeze. What happened and the controls that would have stopped it.
• Human-in-the-loop approval for AI agents: what to ask aboutHow to design approvals that catch the risky 1% without the fatigue.
• MCP security checklist: 10 controls for AI agent toolsTokens, untrusted content, config tampering, malicious servers, approvals and logging.