TL;DR

--dangerously-skip-permissions turns off Claude Code's permission prompts. Tool calls run without asking you. That's fine inside a boundary that limits what they can reach, and risky on the laptop that holds your SSH keys.

A short decision list:

• You want fewer prompts while you watch: try auto mode or an allowlist first. They keep a check in place.
• You want a long unattended run: use --dangerously-skip-permissions inside a container, VM or dev container, as a non-root user, with network egress limited and no host secrets mounted.
• You want to step away and still be reachable: keep a permission mode that prompts, and answer the prompts from your phone.

The problem

A familiar story: you start a refactor, walk to the kitchen, and come back to a terminal that has been waiting on "Allow this command?" for twenty minutes. The second time it happens, a search for how to make Claude Code stop asking for permission turns up --dangerously-skip-permissions. Before using it, it's worth thinking about what it means on a laptop with your SSH keys, cloud credentials and a browser profile on it.

The flag is real and useful. The question is where it's safe to use, and what to reach for when it isn't.

What --dangerously-skip-permissions does in Claude Code

From Anthropic's permission modes page:

• --dangerously-skip-permissions is equivalent to --permission-mode bypassPermissions. Tool calls run immediately, including writes to protected paths.
• A small set of actions still prompt, such as explicit ask rules and recognised rm and rmdir removals of critical paths.
• You can't enter bypass mode from a session you started without it enabled.
• On Linux and macOS, Claude Code refuses to start with the flag as root.
• Anthropic says to use it only in isolated environments such as containers, VMs or dev containers.

The way their sandbox page puts it: permission modes decide whether a tool call runs. Isolation decides what it can reach once it runs. Skip the first and the second is the only thing left.

Option 1: Cut Claude Code prompts with auto mode or an allowlist

Before turning the prompts off, it's worth trying the modes in between.

Auto mode.

claude --permission-mode auto

A classifier reviews each action instead of asking you. Anthropic describes it as a per-action control rather than an isolation boundary. It needs a supported model, and an organization can turn it off.

An exact allowlist for scripted runs.

claude -p "run the test suite" --permission-mode dontAsk --allowedTools "Bash(npm test)" "Read"

Anything outside the list is denied rather than prompted. This fits CI and other jobs with a known shape.

The Bash sandbox. In a manual-mode session, /sandbox with auto-allow restricts shell commands at the OS level on macOS, Linux and WSL2. It only covers shell commands, so it isn't enough on its own for unattended runs.

Option 2: Skip Claude Code permissions inside a container or VM

When you do want a hands-off run, put the whole session inside something disposable.

Run Claude Code in a dev container

Anthropic publishes a reference dev container in the Claude Code repository with a default-deny firewall script. The short version of their guidance:

1. Run Claude Code in the container as a non-root user (remoteUser in the dev container config).
2. Restrict network egress to the domains Claude Code needs. The reference init-firewall.sh does this and needs the NET_ADMIN and NET_RAW capabilities.
3. Don't mount host secrets such as ~/.ssh or cloud credential files. Prefer short-lived, repository-scoped tokens.
4. Use it with trusted repositories. A malicious project can still read anything inside the container, including Claude Code's own credentials.

Then:

claude --dangerously-skip-permissions

Use a throwaway VM or a spare server

A throwaway VM or a small server gives you the same property with a harder edge. Create a separate user, clone only the repos the task needs, and give that user no access to production credentials.

Review what a bypassed session can still reach

• The mounted workspace is still yours. Claude can modify any file in a bind-mounted project, and those edits land on the host. Commit or stash before a long run so you can diff and roll back.
• The network is still a door. Whatever the egress rules allow, the session can reach.
• Review afterwards. Read the diff before you merge it, the same as a pull request from someone else.

Option 3: Keep Claude Code permission prompts and answer them from your phone

The reason to want the flag in the first place is usually not the prompts. It's being away from the keyboard when one appears. That has a different fix.

If you want permission prompts to reach your phone, so a running session doesn't sit blocked until you're back and you can keep the safer mode on, Happier is an open-source app that lets you run and orchestrate Claude Code, Codex and other agents cross-device, from your phone, desktop or the web.

The agents run on your own computers, and the phone, desktop or web app connects to them. Run Happier from your phone covers the setup. It's on GitHub, you can download it here, and there's a Discord.

What that looks like:

• Permission prompts show up on the phone, with push notifications when a session is waiting on you. Allow or deny there. The approvals guide has the details.
• You pick the permission mode per session. The permission chip in a session lists the modes the agent supports, for Claude Default, Read Only, Auto and YOLO. Defaults per backend live under Settings → Session → Permissions, and Apply permission changes decides whether a change takes effect immediately or with your next message.
• YOLO runs Claude Code in bypass mode. For Claude, Happier's YOLO is the same bypassPermissions mode that --dangerously-skip-permissions turns on, so pick it on a computer you'd be comfortable wiping.
• Spawned sessions stay at or below their parent's permission mode. When an agent starts other sessions, a request for a higher mode is rejected. Settings → Actions → AI session spawn policy also has a Permission ceiling, so you can let an agent delegate work while everything it starts stays Read-only.

A pattern that works well: one session in Default on your laptop for anything that touches real credentials, and a second session in YOLO on a throwaway server for the long mechanical work, both visible in the same session list.

The honest limit: Happier relays prompts and settings, and the isolation comes from the computer or container the session runs on.

Troubleshooting

Claude Code refuses to start with --dangerously-skip-permissions

Claude Code refuses the flag as root on Linux and macOS. Check whoami inside the container. Create a normal user in the container or VM and run it as that user.

Bypass permissions mode is disabled in my organization

Admins can disable bypass mode with permissions.disableBypassPermissionsMode in managed settings. Auto mode or an allowlist is the route then.

A running Claude Code session won't switch to bypass mode

Anthropic's docs say you can't enter bypass mode from a session that wasn't started with it enabled. Start a new session with the flag.

Claude Code plan mode didn't stop an edit

In an interactive terminal session with bypass available, Anthropic says plan mode's blocks aren't enforced. Claude is still told to plan, but an edit it attempts can run. Keep bypass off when you rely on plan mode.

FAQ

Is --dangerously-skip-permissions safe?

Inside an isolated, non-root environment with limited network access and no host secrets, it's a reasonable choice for trusted repositories. On your everyday computer, the agent gets the same reach you have.

What's the difference between auto mode and skipping permissions?

Auto mode replaces the prompt with a classifier that reviews each action. Bypass mode removes the check. Neither is an isolation boundary.

How do I make Claude Code stop asking for the same command?

Add an allow rule for that command in your settings, or use --allowedTools for a scripted run. That keeps prompts for everything else.

Does YOLO in Happier work for Codex too?

Happier has YOLO for Codex and other backends, and each provider applies it with its own policy. For Codex it maps to full access with no approvals, so the same isolation advice applies.

Related guides

• How to approve Claude permissions from your phone
• Stop "waiting for approval": fix permission prompts in Claude Code, Codex, and OpenCode
• Human-in-the-loop approvals from your phone for Claude Code, Codex, and OpenCode
• How to log in to Claude Code on a remote server over SSH