{"slug": "claude-code-s-new-even-more-dangerously-skip-permissions-variable-what-it-does-t", "title": "Claude Code's New \"Even More Dangerously Skip Permissions\" Variable: What It Does and Doesn't", "summary": "Anthropic's Claude Code build v2.1.311 added an environment variable named CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS that, when set to 1 in a shell, lets the agent run rm and rmdir without an approval prompt, The Register reported on October 27, 2026. The variable reportedly removes the deletion prompt that even the --dangerously-skip-permissions flag retained, and Anthropic member of technical staff Daisy Hollman announced it on X; The Register says it does not appear in the changelog. Anthropic's permission-modes documentation, which does not mention the variable in the section the post could read, says some critical-path removals such as rm -rf on the home directory remain blocked and that managed settings can disable bypass mode via permissions.disableBypassPermissionsMode.", "body_md": "The Register reported on October 27, 2026 that Claude Code build v2.1.311 added an environment variable named **CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS**. [The Register's story](https://www.theregister.com/ai-and-ml/2026/10/27/anthropic-now-lets-claude-users-jump-out-of-plane-without-parachute/5305807?ref=explainx) says that setting it to 1 in a shell lets the agent run `rm` and `rmdir` without approval. Before, even the `--dangerously-skip-permissions` flag still stopped to ask before deleting. The headline's \"jump out of a plane without a parachute\" is a metaphor for removing that last prompt.\n\nThis post separates what The Register reports from what Anthropic's own documentation says, explains how Claude Code's permission modes fit together, and lists what to do if you run agents on a machine you care about. We could not independently verify the variable's exact behavior, so treat the details as reported.\n\n## TL;DR: what we know\n\n| Question | Answer | \n|---|---|\n| What was added? | An environment variable, per The Register, in build v2.1.311 | \n| What does it do? | Lets the agent run rm and rmdir with no approval prompt | \n| Who announced it? | Daisy Hollman, Anthropic member of technical staff, on X (per The Register) | \n| In the changelog? | The Register says no | \n| Still blocked? | Some commands such as rm -rf on the home directory, per Hollman via The Register; managed settings still apply | \n| Official docs we read | Permission-modes page; does not mention the variable in the part we could read | \n\nAgents that act on your behalf need rules. [Agentbeam stops the dangerous actions →](https://app.agentbeam.com/login)\n\n## How Claude Code permission modes fit together\n\nOur explainer on [Claude Code permission modes](https://explainx.ai/blog/claude-code-permission-modes-explained-2026) covers the ladder in detail. In short, as Anthropic's documentation describes:\n\n- **Default:** the agent asks before risky actions.\n- **Auto mode:** a separate classifier reviews each action. It blocks actions that escalate beyond your request, target unrecognized infrastructure or look driven by hostile content. It became the default for many sessions with v2.1.283 and later, as we noted in[auto mode becoming the default](https://explainx.ai/blog/claude-code-auto-mode-default-pro-max-team-august-2026) .\n- **bypassPermissions:** disables permission prompts and most safety checks, so tool calls run immediately. Anthropic's docs say to use it only in isolated environments such as containers or VMs without internet access.\n\nThe new variable, as reported, sits above bypass mode: it removes the deletion prompt that bypass mode had kept.\n\n## What the docs say stays blocked\n\nAnthropic's permission-modes page lists protections that apply even in bypass mode, including recognized critical-path `rm` and `rmdir` removals: the filesystem root, top-level directories like `/usr`, your home directory, your working directory and its parents, and globs under the working directory. It also flags `rm -rf \"$DIR\"/*` where an empty variable would delete from root.\n\nThat is the behavior the new variable reportedly loosens. The docs also say the check can miss some commands, so it never replaced operating-system controls such as sandboxing. And managed settings can switch the whole mode off with `permissions.disableBypassPermissionsMode`.\n\nThe Register notes Hollman's point that the existing flag did not approve \"everything\": some commands, like `rm -rf ~`, remain blocked. Whether that remains true with the new variable set is the key question to check on a throwaway machine, not your laptop.\n\n## Why would Anthropic add this?\n\nWe can only infer. People who run agents in disposable containers hit the deletion prompt constantly, since build cleanups, `rm -rf node_modules` and temp-directory resets are routine. A prompt in a headless CI job stalls the run. An opt-in escape hatch with an absurd name is a way to say: you asked for this, you own the consequences.\n\nThe naming is a design choice as well as a joke. Long, scary environment variable names are speed bumps that stop casual use and make code review catch it. Recent history shows why the caution is warranted: we have covered cases where agents ran commands users did not expect, such as [Claude Code finding a cryptominer](https://explainx.ai/blog/claude-code-found-xmrig-cryptominer-mac-temperature-app-how-to-check-2026), and an Anthropic red-team study in which [auto-mode monitors failed against 55% of attacks](https://explainx.ai/blog/anthropic-red-teaming-auto-mode-codex-guardian-monitors-fail-55-percent-attacks-2026).\n\n## A short history of skipping permissions in Claude Code\n\nThe Register dates the pattern. The bypassPermissions mode first appeared in Claude Code v1.0.18 on June 9, 2025, reachable through a flag already named `--dangerously-skip-permissions`. Anthropic made auto mode the default in August 2026, which put a classifier between the agent and most actions for everyday users. The new variable is the next rung up, aimed at the narrow group that runs agents unattended in disposable environments.\n\nEach rung follows the same logic. Approval prompts are the main way a human stays in the loop, but they also make agents slow, and the more capable the agent becomes the more users want to remove them. Vendors respond by adding alternative controls (classifiers, sandboxes, deny rules) and by moving the remaining prompt-free behavior behind increasingly alarming names.\n\n## What a safe setup looks like\n\nIf you do want unattended runs, build the safety outside the agent:\n\n- **Disposable container:** start from a clean image, copy in only the repository, and destroy it after the run.\n- **No credentials:** do not pass cloud keys, SSH agents or tokens that the task does not need. A deleted file can be restored; a leaked key cannot be un-leaked.\n- **Network limits:** if the task does not need the internet, cut it. That removes most prompt-injection exfiltration paths.\n- **Resource and time caps:** a runaway loop should hit a limit and stop.\n- **Review the diff:** treat the result like a pull request from a stranger. Look at deletions first.\n\nNotice that none of this depends on Claude Code's own prompts. That is the point: the agent's setting is a convenience, and the container is the control.\n\n## Real risks of unattended deletion\n\n- **Wrong path:** an agent that builds a path from a variable can delete far more than intended if the variable is empty.\n- **Prompt injection:** a README, web page or issue that the agent reads can instruct it to delete files. With no approval step, the agent is the only gate.\n- **Mounted volumes:** in a container, a mounted host directory is just as deletable as the container's own files.\n- **Git is not backup:** untracked files, local`.env` files and ignored build outputs are gone for good.\n\n## How to protect yourself\n\n1. **Do not set the variable on your daily machine.** Use a container or VM that holds only a copy of the repository.\n2. **Mount read-only where you can,** and never mount your home directory or cloud credentials.\n3. **Keep deny rules.** Anthropic's docs say deny rules still block in bypass mode; list paths you never want touched.\n4. **Commit before runs** and keep backups outside the working tree.\n5. **Prefer auto mode** for work on a real machine. It reviews each action instead of waving all through.\n6. **Administrators:** set`permissions.disableBypassPermissionsMode` to`disable` in managed settings if your policy forbids bypass mode.\n7. **Add an independent guard.**[AgentBeam](https://agentbeam.com/?ref=explainx) is the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions, as a layer that does not depend on the agent's own settings.\n\nFor the wider picture of agents taking consequential actions on systems they do not own, see our running tracker at [/felony-bench](https://explainx.ai/felony-bench) and the [legal liability analysis of AI agents](https://explainx.ai/blog/felony-bench-ai-agent-legal-liability-cfaa-august-2026).\n\n## Questions developers are likely to ask\n\n**Is this the same as the old flag?** No. The flag, per Anthropic's docs, disables permission prompts and most safety checks but keeps a prompt for recognized critical-path removals. The variable is reported to remove that remaining prompt for `rm` and `rmdir`.\n\n**Will it work in auto mode?** The docs describe auto mode as classifier-driven with its own block list, including recursive forced deletes whose target variable was never assigned in the conversation. Nothing we read says the new variable changes auto mode, so do not assume it does.\n\n**Can a project file turn it on for me?** The docs say bypassPermissions set in project or local settings files does not take effect, a guard against a cloned repository silently enabling dangerous behavior. An environment variable is different because it comes from the shell that launches Claude Code, so check what your CI, shell profile and dev-container configuration export.\n\n**What should a team lead do today?** Search your dev-container and CI configuration for the name, add it to a code-review checklist as a red flag, and decide whether managed settings should disable bypass entirely for engineers working on laptops.\n\n**What if the agent deletes something anyway?** Stop the session, check version control and filesystem snapshots, and restore from backup. If it happened because of injected instructions, report it to the tool's vendor and rotate any secrets the agent could read.\n\n## What is still unconfirmed\n\n- The exact behavior with the variable set, including which `rm` forms still prompt.\n- Whether Anthropic will document it in the changelog and permission-modes page.\n- Whether managed settings can disable the variable specifically; the docs we read only mention the broader bypass switch.\n\nWe will update this post when Anthropic documents the variable.\n\n## Related reading\n\n*Details are accurate as of October 28, 2026 and rely on The Register's reporting for the variable itself; verify against Anthropic's docs.*", "url": "https://wpnews.pro/news/claude-code-s-new-even-more-dangerously-skip-permissions-variable-what-it-does-t", "canonical_source": "https://explainx.ai/blog/claude-code-even-more-dangerously-skip-permissions-env-var-rm-rmdir-v2-1-311-what-it-does-2026?utm_source=rss&utm_medium=feed&utm_campaign=blog", "published_at": "2026-10-28 00:00:00+00:00", "updated_at": "2026-10-28 18:43:20.021810+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-safety", "developer-tools"], "entities": ["Anthropic", "Claude Code", "The Register", "Daisy Hollman", "CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/claude-code-s-new-even-more-dangerously-skip-permissions-variable-what-it-does-t", "markdown": "https://wpnews.pro/news/claude-code-s-new-even-more-dangerously-skip-permissions-variable-what-it-does-t.md", "text": "https://wpnews.pro/news/claude-code-s-new-even-more-dangerously-skip-permissions-variable-what-it-does-t.txt", "jsonld": "https://wpnews.pro/news/claude-code-s-new-even-more-dangerously-skip-permissions-variable-what-it-does-t.jsonld"}}