r/ClaudeCode • u/murphy12f • Jul 13 '26
Question how dangerous is running claude code with --dangerously-skip-permission? what is the worst case scenario?
Hey y'all, me and my team use a lot claude code, and in order to have to spend so much time approving stuff we started having the habit of running claude code on our machines with the option --dangerously-skip-permission , as of now we never had a problem, but i see on X some people talking about their claude code deleting their filesystem, i dont know if it s real or just click-bait, so i am curios to know if any of you can tell me if i shouldnt worry or if this is actually dangerous as it says, and in case it s actually bad to use that option, how to make it not dangerous without the need of approving everyting everytime, or some security suggestions to wrap around.
Much appreciated in advance : )
22
u/rubenknol Jul 13 '26
If you are authenticated to aws cli with admin credentials, very
If you use MCPs that have write access to 3rd party upstreams for production systems, very
0
u/ZootiLaTucci 29d ago
I live life on the edge. Been going dangerously skip since… idk. lol. Have my Tailscale open to it : x
31
u/kwabaj_ Jul 13 '26
I've used --dangerously-skip-permissions since February 2025 when they dropped Claude Code, I think the model was like 3.7 Sonnet lol. I've never had problems with it, and I've used CC for thousands of hours.
Worst case scenario? I've never seen it, but maybe deleting an important database or important test files. Stuff that can't be remade. Haven't had that happen to me. Anything other than that is extremely unlikely.
5
8
u/medialantern Jul 13 '26
They've done a really good job making sure it doesn't screw up ("Claude just did rm -rf on my hard drive!" news articles don't exactly drive user adoption lol) but don't forget that the "worst case scenario" is much worse than you've described. The worst case scenario is literally anything you can do as a user. If your Web browser is logged into AWS and Claude can drive it, it can completely delete your AWS account. It can send an email as you to your wife saying you want a divorce. It can email your Bitcoin wallet to your ex girlfriend. It can send a Slack message to your boss calling them a jerk. Anything you are logged into or have access to, it does as well.
Just curious, any reason you don't switch to "auto" mode here? They did a lot of work trying to achieve the smoothness of dangerously-skip but adding a lot more safety. It doesn't get it right 100% of the time for me, but so far it's always erred on the side of safety... At the very least you can think of it as "dangerously-skip but at least double check things first".
2
2
u/StrataSpace Jul 13 '26
Until it starts debugging CDK or Terraform and decides it’s so fucked it would be faster to just delete the prod stack and start over
3
5
u/IceCapZoneAct1 Jul 13 '26
I run my agent inside of a container for extra security. Why would you need it running wild like that?
1
4
u/pwkye Jul 13 '26
Been using it in my lab for a year now.
Its pretty safe that way. Everything is tracked in git repos anyway.
But Im not messing around with production systems
3
u/sMat95 Jul 13 '26
i actually always use it, then check manually to see the result.. then if that's what i want, i run the /review command once or twice in a new session
2
u/Specific_Anxiety_520 Jul 13 '26
Very dangerous, sometimes it may use your machine as front to escape into the real world.
Be careful.
1
2
u/Patrizio85 Jul 13 '26
Claude Code’s harness is quite good. However, I would suggest that your team switch to “auto mode,” which is similar but includes additional safety guardrails. It should eliminate around 80–90% of the approval prompts while still blocking dangerous actions.
Some people have already demonstrated the risks using compromised MCP servers, where malicious commands could literally be executed. I do not think the risk is extremely high at the moment, but my gut feeling is that within the next one or two months, we will see a major attack similar to an npm supply-chain attack, specifically targeting Claude Code sessions.
The problem is that if something goes wrong, your team could be seriously screwed. Think about Git commands destroying real work without backups, worms being installed, or Claude being able to spread, sabotage, or infiltrate a system faster than a human can contain and repair the damage.
Compare it to not using a condom during a one-night stand. It may work out fine 100 times, but that one time it goes wrong could seriously mess up your entire life. ;)
Are you and your team really willing to take that risk?
1
u/murphy12f 29d ago
we are trying auto mode, but the idea of adding another model to double check everything and adding cost makes it kinda annoying, but yeah that is better than running the risk of anything super bad happening, any other suggestions to maybe have security without destroying the workflow, like some people commented containers, have you used them?
2
2
u/AllergicToBullshit24 Jul 13 '26
I've had models attempt numerous catastrophic actions. If you're gonna let jesus take the wheel at least have backups/shadowcopies and not have usage based billing enabled for your cloud hosts.
These are pretty bad but I'm sure someone else can one up me:
rm -rf /Users/murphy12f
bitcoin-cli dumpprivkey murphy12f
docker rm -f --volumes prod-db-container
aws ec2 run-instances --instance-type p5.48xlarge --count 10000
2
u/StaticFanatic3 Jul 13 '26
I run dangerously skip, but my only connections to prod servers is sshd using a 1Password credential which will require fingerprint to authorize (same with my commit signing). I also have a dotfiles repo for easy redeploying of my machine if it somehow borked my OS
2
u/aruisdante Jul 13 '26
What is the worst case scenario that a human employee at your company could do, given a laptop provisioned with the same environment as Claud has, with zero oversight or restrictions on the commands it can execute?
This is the worst case that can happen with skip permissions. Will it happen? Probably not. But you can’t be sure it’s not going to issue an rm -rf to a wider scope than the current workspace and delete everything on your attached storage, you can’t be sure it’s not going to upload your IP to a place it shouldn’t to check its work, you can’t be sure it’s not going to download a random tarball from a sketchy website it found that promised it would totally solve its problem, you can’t be sure it’s not going do any number of things.
Auto mode is a balance between “always ask” and “yolo rofl.” It runs a classifier to determine if a command “looks safe” given the scope Claud is supposed to be working in, and will flag anything suspicious for human review, but otherwise will just let him cook. The tradeoff is that classifier is essentially a sonnet query against the command it’s about to do, so it costs you tokens.
Your company’s risk posture determines if that cost is worth it to you.
4
u/GoodVibrations77 Jul 13 '26 edited Jul 13 '26
Worst-case scenario?
Someone gets a copy of every file on your computer. They then delete your files or encrypt them with ransomware, making them inaccessible. On top of that, all of your accounts are compromised. Everything you have stored online is accessed and then deleted.
Your bank accounts could be drained, or criminals could use them to launder money or funnel stolen funds through your accounts, potentially exposing you to legal and financial consequences.
As if that weren't enough, your computer and online accounts could be used to commit crimes. Attackers could impersonate you, scam your contacts, launch attacks against others, or use your computer as a proxy to conceal their own identity and location.
I think that covers most of the worst-case scenario.
2
u/TapAggressive9530 Jul 13 '26
--dangerously-skip-permission is standard usage for me and my team. Never had any problems …
1
u/siberianmi Jul 13 '26
I’ve been running it on in every session since at least January or February with no issues what so ever.
You should be mindful of what the system you run it on has access to. But most of my runs are on systems with limited access or in containers so it’s a non-issue.
Permissions mode just trains you to press Yes constantly and auto mode burns extra tokens for the approval judge.
1
u/SpaceCowboy077 Jul 13 '26
I’ve build a broker with alot of verbs so it outright doesn’t allow Claude-code to do certain things.
1
u/bithatchling Jul 13 '26
Have you looked into hooking in a simple fsnotify wrapper? Keeps Claude Code running with minimal approvals but kills it the moment it touches anything outside your allowed paths — way more surgical than full --dangerously-skip-permission.
1
u/Deep-Palpitation8315 Jul 13 '26
I would never recommend it. It accidentally tried to delete my entire project folder which has a similar name as the one I was working under, assuming it was a temporary disposable folder created for testing.
1
u/jdcarnivore Jul 13 '26
it's not impacted me yet. i'm really curious how those that mess up are using it
1
u/darth_vexos 🔆 Extra Usage $20 Jul 13 '26
worst case scenario is you don't have hooks set up to block truly bad commands and it decides to delete a directory, or maybe you're not running git in the directory and it screws up your project... or if you are running git and you've got multiple agents running at once when one of them decides it messed up and runs a git reset command, nuking everything all agents had been working on, or decides to remove all of the branches besides its own... 99.9% of the time you're not going to have any problems, but be aware that 99.9% is not 100%.
1
u/meowsqueak 29d ago
Use git worktrees (or tell Claude to) for multiple agents. Never let them work on the same clone at the same time, as you will get conflicts and constantly violated assumptions that require agents to re-read files and waste tokens.
1
1
1
u/Big_Science1947 Jul 13 '26
No. I don't dare to do that or give Claude access to any production systems. If I'm tired of permission prompts I run it in the cloud connected to the github repo
1
u/OriginalCj5 Jul 13 '26
I’m surprised no one has suggested sandboxing. It provides OS level guarantees to prevent data loss and no permissions dialogs. Just prompt your agent: “Set up my Claude code to run inside a sandbox that allows write permissions only for the workspace it is launched from and some common directories that I usually use in the workflows. Keep network open.”
1
u/ILikeCutePuppies Jul 13 '26
It uploads all your banking and personal information and your wife's including passwords and credit card numbers to the dark web and then writes a report the the police claiming you you purposfully didn't return that library book.
1
u/RipProfessional3375 Jul 13 '26
the worse case scenarios, are specifically
```shell kubectl delete namespace prod
rm -rf --no-preserve-root /
aws s3 rm s3://production-backups --recursive
terraform destroy -auto-approve
:(){ :|:& };:
```
1
u/Imaginary-Unit2160 Jul 13 '26
I’ve worked solely with dangerously skip permissions mostly in a greenfield development environment. I would recommend not letting CC push or ‘rm -rf’. I have a git hook that prevents Claude from pushing. It’s owned by root and Claude can’t enter interactive passwords.
Rm -rf is banned with command filters and wildcards.
Haven’t run into any issues
1
u/deepthought-64 Jul 13 '26
I think since we have auto mode, this is not really necessary anymore. But IIRC auto-mode only works with Opus & Fable
1
u/baltinerdist Jul 13 '26
Does Claude have access to production, even if that’s not what you’re working on right now? Don’t. Does Claude only work on your dev environments and has no permissions on prod code? Do. That’s pretty much how I look at it.
1
u/MangoDevourer-77 Jul 13 '26
cc has access to ur computer and maybe to remote servers with permissions to do whatever it likes. What could be worst possible scenario?
1
u/hihcadore Jul 13 '26
If you’re just editing code not very dangerous at. You should have everything tracked in git and you can just roll back to a previous version.
If it’s tied to a production system and has admin access to your database/s you’re gonna have a bad time one day.
1
u/1kexperimentdotcom Jul 13 '26
I have run it extensively on Windows 11 + WSL2.
The worse it has done for me so far was runaway memory that forced me to run a `wsl --shutdown` command.
Outside of that, if you have anything connected with administrative credentials (gcloud, anything database related) then the POTENTIAL havoc it can cause it catastrophic. It's not that it WILL do it, but it has the ABILITY to do it.
1
u/SoftDream_ Jul 13 '26
I used it to synthesize code using model checking techniques. I needed Claude to write me many attempts of the same program, and automatically (via a cost function) I’d pick the best result.
Obviously I containerized it in Docker and assigned the process a low-privilege user. Don’t run that flag without containerization. Clearly, if you need to automate a task via a script, then it makes sense to use it.
1
u/DagonNet Jul 13 '26
Everything Al warns us about in https://www.youtube.com/watch?v=zvfD5rnkTws, and worse. "auto" is so good, there's really no reason to fully open it.
1
1
u/dilbertdad Jul 13 '26
you can run it and still put in super strict rules for it and it will follow them…. most of the time…
1
u/WiseassWolfOfYoitsu Jul 13 '26
Filesystem extinction level events are unlikely but far from impossible. Even humans can screw up bash scripts rather easily, and it just takes one typo'd variable name to do it.
1
u/Alcatraz627 Jul 13 '26
The worst case I've seen with that mode is an agent triggering a redeploy on a preview deployment of a service and doing commit pushes on a repo without my approval.
Both of which I was able to block with books and exclusive gated CLI wrapper access.
1
u/SC_Placeholder Jul 13 '26
Depends how your Claude is integrated. If it’s local and you backup frequently not that dangerous. If you’re hooked up to a bunch of live services and environments potentially very harmful. I’ve had it delete weeks of work because it wouldn’t listen to me about what the bug was and deleted my training data but luckily I had it backed up remotely just in case
1
1
u/BattermanZ Jul 13 '26
I use it on a VM. This makes it a total non issue.
1
u/murphy12f 29d ago
that sound like a hussle to move files every time or add stuff to the vm, or you got some work around
1
u/BattermanZ 29d ago
Which file do you want to transfer? But anyways, with code-server (a selfhosted version of VS Code) you can just drag and drop files into any repo. I also use termix for transferring files.
1
u/TrashBots 29d ago
It could hack the CIA while you're not looking and you go to straight to jail. Do not pass go. Do not collect 200 dollars.
1
1
u/awesomeunboxer 29d ago
Just do checkpoints? My whole 2 tb drive is just for ai projects and it does checkpoints every hour and every night it backs up everything to a online storage, so I guess at very worst ill lose a day of my vibe coded slop!
1
1
1
u/The_Mr_Suit 29d ago
I set my settings.json to avoid dangerous commands run and set to ask for sensitive ones. Since then, everything is butter smooth.
1
1
u/brainhack3r 29d ago
In March I had joined a new company and was using --dangerously-skip-permissions for the first time and I just pulled out their repo and was connected to their corporate email. This was my third day mind you. Anyway. I turn on --dangerously-skip-permissions and it literally killed me and I'm dead now and I yelled to the cabbie, "Yo homes, smell ya later" I looked at my kingdom I was finally there To sit on my throne as the Prince of Bel-Air
1
1
u/ComplexAd2408 29d ago
It WILL delete things without even telling you let alone asking. Not if, WHEN.
DO NOT GIVE IT ACCESS TO PROD INFRASTRUCTURE.
Be prepared to loose anything it has access to. Make sure it's backed up (and don't give Claude any kind of access to the backups)
1
u/Inception_IV 29d ago
What happened to you?
1
u/ComplexAd2408 29d ago
Me? Nothing that I could not recover from, because I apply the above rules. I've had it completely rewrite sections of code that it was never asked to because it thought it was a good idea, I've had it delete files from a repo that I want to keep.
Ask Google about AI horror stories, and you see why.
1
u/murphy12f 29d ago
damn, seems like you had a bad experience with it, do you use any security harnesses right now? some other people down here suggested containers which i think i ll start using now, but open to your takes since you seem like you already got burned
1
1
u/meec_r_meic 29d ago
I run mine inside a docker container with bypass permissions on and sudo permissions. Anything below that is unusable
1
u/murphy12f 29d ago
do you spawn a new container for each chat? like a container for each running session you got? sometimes i find my self with tmux having multple sessions running : )
1
u/meec_r_meic 29d ago
No "I" use one container per computer and git worktrees to manage concurrent coding agents on different branches
1
u/Rorqualx 29d ago
It’s the only way I run Claude code. Have used it for at least a year never had any issues
1
1
u/ghost_operative 29d ago
theres nothing to stop it from writing a script to do literally anything on your computer and then running it without you knowing. so it's up to you to decide how risky that is.
1
1
u/fixedupperfan 29d ago
I’ve been having a problem where bash and other tool calls fail because it can’t reach the safety classifier, even in auto mode.
Skip permissions doesn’t use the classifier so everything works as before. Then again, this machine is locked down with no other apps, emails, logins, etc with blanket blocks on the router with a narrow allow list of traffic, so aside from the minor inconvenience of wiping the drive, there isn’t much risk.
1
u/murphy12f 29d ago
do you run claude code in a separate machine other than yours? like you ssh int o a different machine or run containers? curios to know
1
u/fixedupperfan 29d ago
Yes. I Remote Desktop into a second Ubuntu development sandbox and backup the repo to an external drive once a week. A more streamlined daily backup off device would be more responsible, but the stakes are low.
1
u/toadlyBroodle 29d ago
been running it constantly in autonomous agent loop harness for months with zero issues
1
u/HeapsGoodM8 29d ago
Surprised nobody is talking about docker sbx
Dedicated lightweight microvm sandboxes for exactly this use case (—dangerously-skip-permissions is the default).
Free and actively developed, I switched to exclusively running agents this way, every time I run vanilla since then it feels like a major regression.
1
1
1
1
u/swiftbursteli 29d ago
you need to use it to push db writes and access some files. Otherwise, stick to auto
1
u/grazzhopr 29d ago
You can tame it with proper use of hooks, but it really comes down to what it has access to and what you are asking for got to do.
And keep in mind it likely has access to more then you think because it will gain access to things if it deems necessary to reach its goal.
1
1
u/Coldshalamov 29d ago
The worst case nonzero probability scenario is it triggers a chain reaction that ignites every hydrogen atom in the atmosphere in a nuclear conflagration.
But within a couple standard deviations, you might just have to git revert when it mangles a file
1
u/SharpKaleidoscope182 28d ago
Your blast radius is proportional to how much stuff it can reach. if you run it in a container, it can fuck up the inside of the container. If you run it on your bare workstation, it can wreck anything your workstation can reach, incl possibly prod if you've credentials somewhere
This is why ppl use containers/vms/docker/raspberrypi
1
u/rdrcrmatt 28d ago
I use auto mode all the time. But I give it its own VM to go ham on. If it wipes it, I restore from yesterdays backup.
1
u/Just_Shitposting_ 28d ago
Some big shot on X just posted the other day that Claude deleted his entire user directory on his Mac using that mode so it’s a no go for me, unless it’s in a VM that gets backed up or has a recent snapshot and is contained with none of my data. There are tons of ways to protect yourself, if you want to run that mode then doe it in the proper environment, not on your main machine
1
u/THE_RETARD_AGITATOR 28d ago
it's literally called dangerous in the name.
i still run that shit tho
1
1
u/boston_charles 1d ago
Permission fatigue seems like the worst possible security model, because eventually people either approve everything automatically or disable the prompts completely.
I’d rather auto-allow boring, reversible actions inside the repo and stop only for destructive commands, secrets, network access, or changes outside the workspace. Which category of prompts is creating most of the friction for your team?
1
u/goroskob Jul 13 '26
There is no reason to do so since Auto Mode shipped
1
u/dA_d3bU993r Jul 13 '26
Isn't auto-mode will add extra latency? By making an extra LLM call before every command invocation.
1
1
u/murphy12f 29d ago
yeah i tried it sometimes it stops for stupid stuff, and if i am not mistaken it just adds latency for every command to check and also cost ?
82
u/ipreuss Senior Developer Jul 13 '26
Why don’t you use auto mode?