Claude Code's permission modes page lists bypass permissions for "isolated containers and VMs only", and says to use it only where Claude Code cannot damage your host. The rest of this post is why, and what to do instead when the prompts get in the way.
What the flag turns off
--dangerously-skip-permissions is the same switch as --permission-mode bypassPermissions. In that mode tool calls run without asking, including writes to the paths Claude normally protects, such as its own settings. Allow rules stop mattering, because everything is already allowed.
A few things still hold. Deny rules block in every mode, explicit ask rules still prompt, and so does deleting a critical path such as your home folder. The first time you start an interactive session with the flag, Claude Code shows a warning and asks you to accept responsibility.
bypassPermissions offers no protection against prompt injection or unintended actions.Claude Code docs, Choose a permission mode
Why people turn it on anyway
Manual mode asks before most edits, commands and network calls. On a long task that is a long run of questions, and after a while you click yes without reading. A question nobody reads is already a skipped permission, so the flag often just makes an existing habit official.
What can go wrong
On a bare laptop the agent runs as you. It can read ~/.ssh, ~/.aws and every other repository in your home folder, see the secrets in its environment, and reach any host on the internet. Without prompts, nobody reads the command first.
The usual way in is not a rogue model. It is text the agent reads and follows: a README that says to curl a script, an issue comment, a dependency's install step. That is prompt injection, and the flag removes the last person who might have noticed. Our list of AI agent security risks covers the wrong file, the wrong host and the prompt that does not hold.
"Skipping permissions is unsafe."
Revision 1: skipping the questions is fine when a boundary holds without them.Try fewer prompts before no prompts
Claude Code has modes between asking for everything and asking for nothing, and its docs pair each with the isolation it needs.
acceptEdits approves file edits and common filesystem commands while you review the code. auto has a second model, a classifier, review each action instead of you; Anthropic recommends it over bypass for long tasks. dontAsk runs only the tools you pre-approve and denies the rest, which suits CI.
The built-in Bash sandbox, turned on with /sandbox, lets shell commands run without prompts inside limits the operating system enforces. Know its edges: it covers shell commands only, not Claude's file tools, hooks or MCP servers, and by default it can still read most of the machine, credential files included, until you add denyRead rules.
If you skip permissions, put a boundary around everything
Anthropic's page on sandbox environments compares the options that wrap the whole Claude Code process: the open-source sandbox runtime, a dev container, a custom container, a virtual machine, or a cloud session. Run it as a non-root user in any of them.
Each one still leaves something open. Anthropic's development containers page is plain about it: with the flag on, dev containers "do not prevent a malicious project from exfiltrating anything accessible inside the container." That includes Claude's own sign-in in ~/.claude. A project folder mounted writable means every edit lands on your disk as it happens.
Five questions for any boundary
What can it read? The project, and not your home folder, your keys or your other repositories.
Where can it send? A short list of named hosts, with everything else refused. The Bash sandbox docs warn that allowing a broad domain such as github.com "can create paths for data exfiltration."
What does it hold? As few secrets as the task needs, short-lived where possible. Anything in its environment can leave through an allowed host.
How do changes come back? A diff you review beats a folder the agent writes to directly.
Who can widen it? A person, not the agent. Administrators can block bypass mode for a whole organization with permissions.disableBypassPermissionsMode in managed settings. Our notes on the Hugging Face incident show what one open route out can cost, and what agentic AI security means to us comes down to the same questions.
A side note on how we do it
We build Fenzi, which starts Claude Code inside an OpenShell sandbox on your machine with a copy of the project, a short host list and a placeholder instead of the real key; the default access sheet lists it all. It is one way to answer the five questions, and any of the boundaries above can answer them too.
So, is it safe?
On a bare laptop, no: the flag hands the model your account and your network. Inside a boundary that limits what the agent reads, where it sends and what it holds, a skipped question costs you a diff to read. Decide the boundary first, then decide how many questions you want. Anthropic's sandbox environments page is the place to start.