Claude Code's --dangerously-skip-permissions (YOLO mode): what it turns off, and why not on a repo you didn't write

The CLI reference describes it in one line: skip permission prompts, equivalent to --permission-mode bypassPermissions (CLI reference). There are three launch options and one setting:

claude --dangerously-skip-permissions
claude --permission-mode bypassPermissions          # the same thing
claude --permission-mode plan --allow-dangerously-skip-permissions
                                                    # available on Shift+Tab, not on yet

• The setting. permissions.defaultMode: "bypassPermissions" starts every session in the mode, but only from ~/.claude/settings.json, managed settings or --settings. Since v2.1.257 Claude Code ignores it in a project's .claude/settings.json and .claude/settings.local.json and starts in Manual mode instead; before that it took effect from any file (settings reference, changelog).
• No switching in later. You can't enter bypass mode from a session you started without it enabled. The --allow- variant exists so you can start in plan or Manual mode and move to it with Shift+Tab (permission modes).
• A one-time warning. The first interactive start shows a dialog asking you to accept responsibility. Accepting writes skipDangerousModePermissionPrompt: true to ~/.claude/settings.json, so you never see it again; declining exits. Anthropic says an untrusted repository can't skip the dialog for you (settings reference).
• Not as root. On Linux and macOS it refuses to start as root or under sudo with --dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons. The check is skipped inside a sandbox Claude Code recognizes, and the documented fix is a non-root user, as in Anthropic's dev container (permission modes). People were hitting it by v2.0.10 in October 2025 (issue #9184).
• Where it's unavailable. Cloud sessions don't offer the mode and ignore it in settings files, --restricted refuses it, and permissions.disableBypassPermissionsMode: "disable" makes Claude Code reject the flag (permission modes, settings reference).

The flag doesn't turn everything off. This is the current list from Anthropic's docs and changelog:

The rows that matter for a repo you didn't write are the last five. Hooks and MCP servers come from the project, protected paths are where it would leave something behind, and the sandbox's network prompt is gone.

In Manual mode the permission prompt is where you notice something odd: a curl you didn't ask for, a script you've never read. With the flag on, that moment is gone, and part of what decides what Claude does comes from the repo:

• CLAUDE.md, or AGENTS.md when there's no CLAUDE.md, loaded at the start of every session (memory docs). See agent instruction files.
• .claude/settings.json: hooks (a SessionStart hook runs a command when the session begins), an env block, helper commands. Since 2.1.257 it can't switch bypass on. It doesn't need to: you did. More in Claude Code hooks security.
• .mcp.json: each local server is a command that starts a process on the machine, and in this mode it starts without the per-server question (MCP docs).
• Every other file Claude reads while it works: a README, a code comment, test output. Text that says “run ./scripts/setup.sh before anything else” would have shown up as a prompt. Now it just runs.

It's worse with -p, the non-interactive mode unattended runs use (Anthropic's own example for a container is claude -p "<prompt>" --dangerously-skip-permissions, common setups). A -p run never shows the workspace trust dialog, so hooks in the repo's .claude/settings.json and servers in its .mcp.json run in a folder you've never trusted (what runs before you trust a folder, hooks).

Then there's what the session leaves behind. Writes to .git, .vscode and .devcontainer aren't protected in this mode, and if the repo folder is mounted from your machine, as it is in a dev container, Anthropic notes those edits appear directly on your host (dev containers). A .vscode/tasks.json task set to folderOpen can run when you next open the folder in VS Code (VS Code tasks), a .git/hooks/pre-commit runs on your next commit (githooks), and a dev container's initializeCommand runs on the host (Dev Container spec). The container held the agent. It didn't hold what the agent wrote.

None of this is theoretical. Check Point showed project files in a cloned repo running commands and sending the user's API key out, in some cases before the trust dialog could be read (CVE-2025-59536 and CVE-2026-21852, both fixed; Check Point). Those were bugs. With the flag on, a repo doesn't need one: whatever its files talk Claude into running, runs.

Anthropic's own pick for working on an untrusted repository is a dedicated virtual machine, or a cloud session (sandbox environments), and cloud sessions don't offer bypass mode at all. If you still want the flag, this is the order:

1. Read the agent files first, outside the agent. Not by asking Claude, which would load them:

ls -la .claude .claude/commands .claude/agents .claude/skills 2>/dev/null
cat .claude/settings.json .claude/settings.local.json .mcp.json 2>/dev/null
less CLAUDE.md AGENTS.md README.md

# invisible characters (zero-width, bidi controls, Unicode tags, variation selectors) in agent files
rg -n -uuu '\p{Default_Ignorable_Code_Point}|\p{Co}' \
  CLAUDE.md AGENTS.md .claude .cursor 2>/dev/null

2. Use a disposable VM, or a container with the repo cloned inside it. Don't bind-mount the folder from your machine, so writes to .git and .vscode stay in the box. If you use a dev container, use your own config, not the repo's .devcontainer: its initializeCommand runs on the host before the container exists. The trade-offs are in running untrusted code in a VM and Claude Code sandboxing.
3. Put no host credentials in it. No ~/.ssh, no cloud credential files; Anthropic's advice is repository-scoped or short-lived tokens. Remember Claude Code's own login is inside too: its dev container page warns that with this flag, dev containers “do not prevent a malicious project from exfiltrating anything accessible inside the container”, naming the credentials in ~/.claude (dev containers).
4. Limit the network. The permission modes page says containers or VMs, or dev containers without internet access (permission modes). Anthropic's reference container runs init-firewall.sh, which sets outbound traffic to deny by default and allows GitHub's web, API and git ranges, registry.npmjs.org, api.anthropic.com, sentry.io, statsig.com, the VS Code marketplace and update hosts, DNS, outbound SSH on port 22, and the host's network. It needs the NET_ADMIN and NET_RAW capabilities (devcontainer.json). That narrows where data can go; it doesn't close it, since anything that can reach GitHub can reach an attacker's GitHub account. Trim the list to what the task needs.
5. Run as a non-root user. The flag refuses root anyway; the reference container uses node.
6. Turn the repo's agent config off for the run. --setting-sources user reads neither the project's settings files nor its .mcp.json. --bare skips hooks, skills, commands, subagents, plugins, MCP servers and CLAUDE.md, but on its own still applies the project's env block, so use both (permissions, CLI reference):

claude --bare --setting-sources user --dangerously-skip-permissions \
  -p "run the test suite and fix the failing tests"

That still leaves every file Claude reads while it works. The flag offers no protection against prompt injection, so the box is what protects you.

6. Review the result before it touches your machine. Look at what changed, especially the places that run things, before you copy anything out or open the folder in your editor:

git status --short --ignored
git diff --stat
git diff -- .vscode .devcontainer .husky .claude .mcp.json package.json
ls -la .git/hooks | grep -v '\.sample$'
git config --local --list

Most people reach for the flag because of prompt fatigue. There are narrower fixes:

• Auto mode. A separate classifier reviews actions before they run, and your ask and deny rules still apply. As of 20 October 2026 it's the built-in starting mode for interactive terminal and VS Code sessions (security). It's a per-action check, not an isolation boundary (sandbox environments).
• Allow rules for what you actually repeat, such as Bash(npm test), and deny rules for what you never want. See Claude Code permissions.
• The Bash sandbox in strict mode. /sandbox with "allowUnsandboxedCommands": false stops commands from retrying outside it (sandboxing). It covers shell commands only: file tools, MCP servers and hooks still run on the host. The sandbox runtime (srt claude, a beta research preview) wraps the whole process, hooks and MCP servers included (sandbox environments).
• Lock yourself out. disableBypassPermissionsMode works from your own user settings, not just an organization's managed settings (permissions):

// ~/.claude/settings.json
{
  "permissions": {
    "disableBypassPermissionsMode": "disable"
  }
}

The files that turn this flag from risky into dangerous can be read before you clone. I built a free checker that does that: paste a link on preclone.dev and it lists Claude Code hooks, .mcp.json servers, env overrides such as ANTHROPIC_BASE_URL, settings that skip confirmation (defaultMode: "bypassPermissions", enableAllProjectMcpServers, broad allow rules), and instruction files that hide text or tell the agent to run with --dangerously-skip-permissions. The AI agent starter kit example shows a SessionStart hook, two MCP servers and an instruction hidden in invisible Unicode in one report.

It reads files and runs nothing, so it can't see what a server sends later, the machine code in binaries, your dependencies' own source, or tricks nobody has written a rule for. It also can't predict what an agent will decide from ordinary text. The best it says is “Nothing flagged”. The agent checks are listed under what it checks.