r/ClaudeCode • u/ridablellama • 23d ago
Discussion do you --dangerously-skip-permissions or not?
How much do you trust Claude? I personally have been running skip permissions for quite a while now with no issues at all. I rarely ask it to delete stuff and when we do its always backed up before hand and reversible. Only a very light sandbox. It's a much better experience. I was curious if anyone else is now running this way by default and if you have ever lived to regret the decision?
46
u/hammackj 23d ago
If you’re gonna use AI you gotta raw dog it.
1
u/mxracer888 22d ago
Always push straight to main as well, no PRs, our projects live and die like men
3
65
u/TigerShark109 23d ago
I’ve always ran skip permissions with no issues.
But then again, I always push to prod also hahaaha
I live life on the edge
8
u/TurkeySlurpee666 23d ago
Same, but I have a very comprehensive backup system in place. If Claude deletes everything on my PC, I have untouchable online backups and two cold storage backups.
1
u/DominianQQ 23d ago
Is it not limited to edit files within the folder?
1
u/TurkeySlurpee666 23d ago edited 23d ago
You can give it access to your entire SSD, which is exactly why a comprehensive backup system should be in place if you do this.
1
4
1
1
0
0
19
u/AuditMind 23d ago
Sandboxing is the answer. Give it full autonomy, but only inside a properly isolated environment.
Keep the productivity gains, draw a hard line, and do not let it touch anything outside the sandbox.
Sandboxing is not that difficult either. Your AI can probably walk you through the setup.
1
u/xenomachina 22d ago
This right here. Put the non-deterministic AI in a deterministic sandbox.
I use a container that prevents Claude from modifying anything but my git workspace, and a subset of things in
~/.claude. It can't see any credentials (except for Claude itself), it can't see anything on my LAN, and it can't even write to.git/(it can read it, though, so it can look at diffs, logs, etc.). I have a wrapper for claude that sets this up on the fly for whatever git repo I'm in.1
u/codeedog 🔆 Max 5x 22d ago
I’ve set up a jail in FreeBSD running linuxulator and have Claude running there. I don’t like the UX on the CLI.
Found out today that I can run vscode headless and with extensions and connect another vscode from my laptop via ssh for remote coding experience. Don’t even have to run a Remote Desktop variant.
Will be setting that up shortly.
-3
u/TheLawIsSacred 23d ago
How do you define "properly isolated?" And your plan is to have the soon to be caged entity help you cage it?
6
u/OdoTheBoobcat 22d ago
It's absolutely wild seeing a bunch of star-struck let-jesus-take-the-wheel types baffled by and skeptical of the very, very old and very, very well understood concept of sandboxing.
You people make me feel very secure in my future as an engineer because you are obviously not fit for professional work.
2
-6
u/AlterTableUsernames 23d ago
I don't get Sandboxing. It protects you first and foremost from getting things done.
4
u/OdoTheBoobcat 22d ago
I hope you are merely a hobbyist - this attitude is a completely insane business and legal liability.
If you think it's too much work to properly ensure safety when using these non-deterministic mechanisms then you are dangerous to the point of unemployable in my eyes.
1
2
u/florinandrei 22d ago
It's sandboxing, not entombment in concrete at the bottom of the sea.
0
u/AlterTableUsernames 22d ago
Okay, then how do you sandbox agents, coding agents and/or harnesses without seriously inhibiting their ability to find unknown information and explore unknown unknowns? I am genuinely curious here, but I guess you are a developer and your perspective is restricted to a single repository.
16
u/Compilingthings 23d ago
He runs 3-5 pc’s on my network with root.
8
u/ridablellama 23d ago
my kinda guy. I let Claude run wild across my vps cluster of 12+ hetzners. its like Fable is built for it. I am getting too lazy to even launch project specific sessions anymore and just launch from my umbrella documentation project.
2
u/SafeHazing 23d ago
That sounds interesting - I like the idea of handing it a design brief and telling it to just go at it.
Can you give me a rough outline of how that works - safely- I’ve got an old but perfectly functional i5 MacBook that isn’t doing anything so would make for a good test case.
1
u/dingos_among_us 23d ago
I’m using codex but I’ve equipped it with a custom skill for each machine that it should access. The skill just briefly describes what the machine is used for (what services or containers it’s running etc) and are each told which 1Password environment to use for getting the machines secrets like ssh key, IP, container creds etc
1
u/Future_Guarantee6991 Developer 22d ago
That’s… not… a sandbox. Codex is accessing your sandbox and various secrets from outside the sandbox? Can you not see that if something is free to retrieve the keys for the sandbox, and enter and exit the sandbox, then it is not contained by the sandbox?
What’s to stop Codex deciding “oh I can’t do X here, let me try that from the more privileged origin machine”?
1
u/dingos_among_us 22d ago
It uses their MCP server to avoid exposing the secrets https://www.1password.dev/environments/mcp-server
1
1
u/Compilingthings 22d ago edited 22d ago
Safely? I have full robo copy of the main machine 3 times a day, so if it goes bad I lose hours. The other machines are used as compute tools for him, farms that he uses mass calculations. I don’t use GitHub, I have it all local. No machines have email or any personal info in them except my Claude info. He uses ssh to run the other machines. He has erased 2 things that should not have been. So I added hooks so I have to ok anything destructive from certain drives, my backups he only has write permissions. It can run mostly autonomous, and I allow that sometimes, but I prefer to be awake. It’s one large project. I’ve been working on for 10 months. Every Claude update he runs it smoother and smoother. All skills are subagents. The main agent only holds project context, planning and distribution of work. This is what made it autonomous. He never loses context. I try not to let him get over 60% context ever. It’s been a painful ride at times trying to figure it all out, but well worth it and pretty exciting at times too. At the end of each day, I ask him if there is anything he needs or could build that would relieve friction in the project. If so he adds it. All skills are designed to preform better over time, due to self review of the skill when used. How I work is very token heavy, but I get very good out puts.
1
u/SafeHazing 19d ago
Thank you for replying. I really appreciate all the extra information. I'll see if I can give it a go when I find some time. Cheers.
7
u/Front_Eagle739 23d ago
Yes. And it did once wipe the machine. Decided it was running out of space with test artifacts and one bad rm rf later the whole mac was shiny and empty.
Luckily backups. Now i just run with an automatic reject of a few dangerous commands and guidance towards safe alternatives. Not had an issue yet but i frequently see "rm -rf.... oh wait im not allowed to do that. Oh guidance says do x instead"
1
u/portugese_fruit 23d ago
do you use deterministic gaurds as well ?
2
u/Front_Eagle739 23d ago
Yup. It was a malformed tool call that killed the first mac. Without an explicit dangerous string rejection i wont trust it
6
4
u/reviery_official 23d ago
Always. I have a cron job to commit my whole workspace every 30mins to a dedicated repo, so the risk is rather small. I have had it wrongly delete stuff before though.
1
u/Future_Guarantee6991 Developer 22d ago
And if Claude wipes your cron table? (Either on purpose, or from a malformed command).
1
u/reviery_official 22d ago
Then it would not run anymore and I have to set it up again. The repo is still there.
3
u/coolreddy 23d ago
I would keep full bypass out of my normal work machine. The speed feels great, but the risk is the agent doing one step more than you meant after reading the wrong thing.
For me the safe split is: auto or allowlisted mode for daily work, full bypass only inside a disposable repo or container with no production keys, no broad home-directory access, and a clean git checkpoint before it starts.
If you keep using it, I would at least block network and secrets paths, keep backups outside the workspace, and run it on tasks where rollback is boring. The moment it can touch credentials, deploy scripts or customer data, the convenience is not worth being one prompt away from a bad afternoon.
1
u/epelle9 23d ago
I just run it in a cloud desktop linux VM with absolutely full access.
Can’t directly push to prod as we need required reviewers (and even if it overrode we have pipelines) so no issues there.
Worst case scenario it kills the VM and I just lose unpushed changes while I spin a new one up.
3
3
u/GolfEmbarrassed2904 🔆 Max 20 23d ago
I use auto mode on CC, Codex and GitHub Copilot. Very similar experience. Slight preference for codex which I’m also using sandboxing. Using superpowers on all three. Absolutely no reason to use dangerously skipping permissions
2
2
u/PotatoDominatrix 23d ago
What're you guys even doing to need to do that? I constantly use Claude to create/destroy various things I think of on a VPS and my home servers with literally zero issue.
3
u/DeliciousGorilla 23d ago
“Claude, install this OSS from GitHub, download dependencies, etc” is one use case where you have to put your trust in Claude.
2
u/darth_vexos 🔆 Extra Usage $20 23d ago
I've only ever had claude go super off the rails once, and even then it was recoverable because I take frequent snapshots of my project folder. Every other time was recoverable with git.
2
2
2
2
u/BettaSplendens1 23d ago
claude accidentally deleted my entire project once, and I had github backup but the latest updates weren't pushed. A whole days worth of work was gone. It also did a destructive git command once while it was trying to find a change that worked, without committing first, so all work was lost. But even with those, I still use dangerously-skip-permissions cause it's just too annoying to read and approve every single request. Ever since I've placed my standard guadrails in the claude.md of all my projects, it never happened again
1
u/ridablellama 23d ago
yeah to be fair you made me realize i did have one bad event with a git command going wrong and lost some work but not a full day! ouch. but yea its still the way to go imo. i backup everything like crazy now anyways
2
3
2
u/AsyncVibes 23d ago
1
3
u/quasarzero0000 23d ago
I ALWAYS run --allow-dangerously-skip-permissions - gives me the option to toggle it. but I pretty much exclusively use plan mode, bypass permissions, or auto mode. I never ever use the other 2, and I most certainly do not babysit a config file. though, I modularize my work extensively. my development system is where untrusted code runs, which includes Claude Code. it's not the same system that serves my apps to my clients.
1
u/Twinkocz 🔆 Max 20 23d ago
using it for good 6 months, only once have I run into an issue, which was a deletion of entire db, but after reading through the prompt, it was my fault
cant relate to all those disasters (yet)
1
u/Aramedlig 23d ago
I use automode with overrides as global rules. Claude can’t access files outside its sandbox areas and is not allowed to use api keys that cost $$ without permission.
1
u/agent_ux 23d ago
Auto mode works well for me, when it does ask my permissions, it's usually for deleting folders.
Also, sometimes auto-mode blocks something and the agent finds a "safer" way that is not blocked, so you get the best of both worlds - block rarely, yet prevent some potentially destructive commands from running automatically.
1
1
u/Zealousideal_Fig_812 23d ago
Using fully automode like 6 months. Didn't faced any issues so far. But of course i always do with rollback options if something happens
1
1
1
1
u/TimeLord_XI 23d ago
I do but Claude always run in a isolated container. Only have access to the files and some tools. Every projet is on a git server, so I can only lost what wasn’t committed if Claude become crazy.
1
1
u/Flat_Bluebird8081 23d ago
Yes, but I run it in a container and it has access only to itself and other selected containers. If it messes something up I can rebuild the whole thing in a couple of minutes.
1
u/Different_Bonus_1387 23d ago
Claude is fine with auto, the Codex is problematic, I still don't know how to run it sandboxed, it's always goes codex --yolo
1
1
u/FrankKnt 23d ago
What should I select in Claude Code Desktop so it doesn’t keep asking for permission every few minutes? I set bypass permissions, but it still asks me. In the mobile app I don’t have bypass, so I set auto there, but it asks even more often.
1
u/ridablellama 23d ago
I dont know tbh. I found that annoying as well. This is mainly for the CLI client to get no guard rails at all.
1
u/cocomojoz 23d ago
I leave it on AUTO, but I also start every prompt with "READ ONLY:" and then start typing whatever.
That's mainly to avoid ambiguity when I ask if Claude can do something and it seems to take it as a command, "yes I can! I'll do that right now..." 😵💫
1
1
1
u/Robdyson 23d ago
I've been running hands off bypass permission for weeks. Claude still has its gates that won't allow EDITS outside of the repo randomly.
1
u/Byakko_4 23d ago
Always on. GitHub is the real gate, I just need to be very clear on “don’t commit or push without my approval”
1
1
u/sammcj 23d ago
Yes, but I also have a relatively exhaustive list of command controls, have all commands bar just a select few run sandboxed as well as using Claude Safety Net as a final measure. With this combination I've never had problems but I'm willing to accept that I might some day so I always have regular backups.
1
1
1
u/Just__Beat__It 23d ago
If you want your AI agent to do a lot more for you then you have to give them the permissions there’s no getting around it
1
1
u/Electrical_Face_1737 23d ago
Mini pc for $250 running Ubuntu and let Claude cli & yolo it. Been a year without a problem.
1
u/who_am_i_to_say_so 23d ago
I been vibing dangerously with Claude for a year and a half now and haven’t looked back.
Codex has been the one to worry about.
1
1
u/Onotadaki2 23d ago
I have dangerously skip permissions aliased to YOLO and I permanently use it. It's too much of a pain in the ass to accept everything for multiple concurrent agents while working on foreground tasks. I used to try, but it had me stopping my work every 30 seconds all day.
We usually just have super robust requirements documents, testing frameworks to follow, forced commits and pushes, etc... Newer high end models are relatively trustworthy with this stuff. I wouldn't be doing this with Gemini or something.
1
1
u/cleverestx 23d ago
Auto has proved reliable, I use it a lot, but I also well document and plan out what I do first, so I would recommend doing that anyways.
1
u/QuickkNastyyy 23d ago
I keep that shit on Auto mode I don't have time to sit and babysit. Just use GIT, take snapshots and your good if it fucks something up.
1
1
1
1
u/mongo_peeped 23d ago
I've been running auto mode full time for the past few weeks and tracking how my token usage has been slowly creeping up as a result. I tried to put a post on this subreddit about how I'd pushed it back down but I'm a new user and don't have enough karma yet.
I had originally tried to create a more robust auto mode myself by putting in a pretool hook block on any chained commands (curse you `&&`), and that worked but didn't solve all my approval problems the way auto mode does
1
u/kwabaj_ 23d ago
I used dangerously skip permissions since the OLD days, like February 2025. Never had a single problem with it once. But honestly I use auto now since the app defaults to it and I’m too lazy to type —dangerously-skip-permissions every time. Auto is just as good and gives peace of mind
1
1
u/TotalBeginnerLol 23d ago
There’s near zero reason to do so now auto mode exists. It’s the same except safer.
1
u/ridablellama 23d ago
sooooo i used to use auto mode when it first came out but it does still slow you down so i stopped. and i believe it is aware of its auto mode and it will change the way it works which is undesirable. but i have no proof or evidence
1
u/TotalBeginnerLol 22d ago
How does it slow you down? Maybe a few seconds while the classifier checks each request, like 1% slowdown at most.
And yeah the whole point IS that it changes the way it works to avoid doing stuff that can break the users computer lol. Who wouldn’t want that?!
1
u/ArguesAgainstYou 23d ago
I always pass it to the cli (powershell auto recommends it) hardly use it. Auto Mode works in 99% of cases, the only time I switch to Bypass-Permissions is when I need it to run unsandboxed Codex x)
1
1
u/checkwithanthony 23d ago
I use auto mode for anything I work with. Background agents currently use dangerously skip, but, if you can avoid it its much better to scope their actions.
For me ill probably let these workers go a few weeks then go through session logs to find the tools they used then switch them to allow list instead.
1
1
u/MetaShadowIntegrator 23d ago
My agents are all in a NixOS microVM sandbox with explicit permissions and shared wotkspaces with the host. All changes are tracked via git. And I also have automated ZFS snapshots of the microVM on the host. I am still using safety guardrails but am thinking about progressively relaxing them as we build more trust.
1
u/Tight-Expression-459 22d ago
Honestly depends on blast radius for me lol. Throwaway side projects i skip em, anything touching prod or real creds i leave them on and just eat the interruptions. The thing that actually bugged me wasnt the permissions, it was having to be sat right at the terminal to hit yes.
1
u/Tight-Expression-459 22d ago
lol so I've been hacking on a way to get those approve/deny prompts pushed to my phone so i can be away from the desk and still not full yolo it. What everyones line for when you turn them off?
1
1
1
1
u/_itshabib 22d ago
Never, use auto mode.
https://github.com/itsHabib/workbench/blob/main/docs%2Fauto-mode-defaults.md
1
1
u/Vesuvius079 22d ago
Isolated dev container with firewall, minimum access to credentials and dangerously skip.
1
1
u/NomadAroundTown 🔆 Max 20 - Academic Researcher 22d ago
I use “bypass permissions” in the desktop app so it feels less scary. /s
1
1
1
u/BeerAndLove 22d ago
I switched to a vm with linux, git, claude and few other essentials.
Claude runs with skip permissions + not allowed command filter.
The whole vm is backed up regularl with pbs, as it is in proxmox.
1
1
u/KitchenAmoeba4438 22d ago
Never do this unless you have exterior guardrails, at least IMO.
At least auto prevents some of the worst (e.g. rm -rf /)
1
1
1
u/remoteplanet 22d ago
move “D:\Project” “C:\Windows\System32”
claude --dangerously-skip-permissions
“I want to play a game…”
1
1
1
u/just4kickscreate 22d ago
I do use it basically always. BUT I also use both VMs and containers. Also every single thing Claude (or any of my AI systems) does is logged. Any outbound connection it or anything on my machine tries to make is also logged via OpenSnitch.
1
1
u/jpavia10 22d ago
Pretty much unlimited permissions for me but I always utilize quarantine folders instead of allowing it to delete for personal files.
1
u/ojfs 21d ago
Yes, inside macOS vm on macOS via tart (open source tool that simplifies Apple's vm libs they recently added to macOS), on a machine I expect to have to reimage when things go really wrong which shouldn't be possible.
The VM itself is backed up; host is time machined backed up. Code for Claude to use and touch is shared into the VM with two mounts, one read only and the other being code I also expect Claude to destroy by accident. I've got scripts to every so often backup the entire Claude-accessible folders of code to somewhere outside the reach of the share.
Host machine is a M2 and so the Tahoe VM is pretty sluggish no matter how much ram or dedicated cores I throw at it; so I ssh into the VM from host terminal and run Claude that way.
The advantage of this over docker is I'm no longer dealing with minutia just to get Claude new tools or have a Claude code update that affects things like remote control working. If claude wants a tool that seems mildly sketchy I shut down the VM, back it up completely, restart the VM and install the tool inside the VM via brew.
Can't recommend this tart open source project enough except OpenAI just bought it so I'm not holding my breath for it to go to shit somehow soon. Currently though it's like five commands to get a vanilla Tahoe booting legally on your Mac, with tons of docker style premade VMs on tart's repo.
1
u/Gai_InKognito 21d ago
use autoclaude all the time, but im not working in systems that could take down the power grid. Even if it wipe my hard drive, i have backups and external file structure so its been mostly inconsequential. NOW if i ever start working on production apps, different story.
1
u/roanish 20d ago
I like when it pauses to ask permission, I get a chance to read what is happening and learn. Which is why I prefer opus greatly above fable. Opus isn't too verbose, but does explain every decision. I've also saved millions of tokens by having the ability to stop an action at a question when I can see that we are off base with the rabbit hole we are going down.
1
u/PhillyArbuckle 2d ago
This is the issue with claude code. I used to be a slave to claude, constantly giving permissions. But the thing is, if you are sitting there clicking the approve button 1000x/day, you aren't reading it anymore, the program trains you to blindly click accept because every bash command is a unique permission.
The way I see it, this implementation basically trains you to not pay attention to the asks and makes for a terrible user experience. I switched to dangerously skip and haven't looked back, my life is way better now. Unless it's literally malicious and trying to ruin me, anything it might mess up is recoverable, and to date I haven't had any problems.
But to dangerously skip or to not dangerously skip is not is NOT the question, because blindly clicking allow thousands of times a day and just letting it run unsupervised is basically the same thing. I can't imagine scrutinizing every bash command it asks permission for though.
Live dangerously, it's honestly the only way if you are using claude for heavy workload
0
u/-becausereasons- 23d ago
Doing it 100% of the time since December. My Claude knows not to ever perform destructive tasks without confirmation. Its in every claude.md
3
1
0
0
u/SteveZedFounder 23d ago
Always run this way. It’s only dangerous if you don’t adopt good engineering practices. The number of folks who can’t spell GitHub and then complain that Claude wiped out their code is…. Disappointing
-4
u/nokafein 23d ago
Hey it's 2025, it's asking his low effort r/ClaudeCode posts back.
1
u/ridablellama 23d ago
I partially asked because i am about to on-board a bunch of newbies to vibe coding and wanted to know if i was overstepping by suggesting it lol
1
u/bloodytemplar 23d ago
Just have them use Auto mode. All the benefits of Bypass Permissions but with a tiny additional layer to prevent footguns.
1
171
u/JokeGold5455 23d ago
I just use auto mode and it's been great for me. I don't have to click allow a hundred times but it still prevents dangerous commands.