By Abdullah Zulfiqar · Tested on Claude Code v2.1.309 · Docs checked 24 October 2026
What is Claude Code YOLO mode? It’s the nickname for running Claude Code with –dangerously-skip-permissions, which starts the session in the bypassPermissions permission mode. Claude stops asking before it edits files, runs shell commands or fetches URLs. Anthropic’s own help text says the flag is “recommended only for sandboxes with no internet access”. For most people there’s now a better option: auto mode, which also removes routine prompts but has a safety classifier check each risky action first.
Below: what the flag actually skips, what still stops it, how to run it without wrecking your machine, and when to use auto mode instead. Everything here was checked against Anthropic’s docs and tested in a real Claude Code session.
Quick answer – Command: claude –dangerously-skip-permissions (same as claude –permission-mode bypassPermissions) – Unattended run: claude -p “your task” –dangerously-skip-permissions – Only use it inside a container, VM or sandbox runtime, as a non-root user – Want fewer prompts on your own laptop? Use auto mode: claude –permission-mode auto
What is YOLO mode in Claude Code? #
“YOLO mode” isn’t an official name. Anthropic calls it bypassPermissions, one of Claude Code’s six permission modes. Developers started calling it YOLO mode because you’re telling the agent “do whatever you need, don’t ask me”.
Normally Claude Code s before anything that changes your system. In Manual mode it asks before most file edits, shell commands and network requests. That’s safe, but on a long task you can end up pressing “Yes” dozens of times.
Here’s what that looks like in a normal session. We asked Claude to add a function to a file, and it stopped to ask before running the shell command:
A real permission prompt in Manual mode, Claude Code v2.1.309. Note option 3: newer versions offer to switch you to auto mode right from the prompt.
YOLO mode removes those prompts. The official docs describe it like this: bypassPermissions “disables permission prompts and safety checks so tool calls execute immediately”, including writes to protected paths like .git and your shell config files.
If you’ve used OpenAI’s Codex CLI, it’s the same idea as Codex’s yolo flag. We covered that one in our Codex CLI YOLO mode guide.
How to turn on Claude Code YOLO mode #
There are four ways to start a session in bypassPermissions mode.
**1. The flag (most common)**
claude –dangerously-skip-permissions
**2. The permission-mode flag (identical result)**
claude –permission-mode bypassPermissions
The docs state plainly that –dangerously-skip-permissions is equivalent to this.
3. Make it available, but don’t start in it
claude –permission-mode plan –allow-dangerously-skip-permissions This starts you in plan mode and adds bypass mode to the Shift+Tab cycle, so you can switch to it later.
4. A settings file
{
“permissions”: {
“defaultMode”: “bypassPermissions”
}
}
Put this in your user settings (~/.claude/settings.json). It doesn’t work from a project’s .claude/settings.json or .claude/settings.local.json. Claude Code ignores bypassPermissions there and starts the session in Manual mode instead, so a repository you clone can’t switch on YOLO mode by itself.
Here’s what the flags look like in the real claude –help output on our machine:
claude –help on Claude Code v2.1.309: “Bypass all permission checks. Recommended only for sandboxes with no internet access.”
You can’t switch into it mid-session
You can’t press Shift+Tab into YOLO mode from a normal session. Bypass mode only appears in the cycle if you started with one of the four options above. We checked: in a session started without the flag, Shift+Tab cycled through manual, accept edits, plan and auto, and never offered bypass.
Our real session: Shift+Tab goes manual → accept edits → plan → auto → manual. Bypass permissions only joins the cycle when you launch with the flag. Our test session started in Manual mode; the docs list cases where that happens even on new versions, such as organization policy.
The first-run warning
The first time you start an interactive session in bypass mode, Claude Code shows a warning asking you to accept responsibility for actions taken without permission checks.
- If you accept, it saves skipDangerousModePermissionPrompt: true in ~/.claude/settings.json, so you won’t see the warning again. Delete that key, or set it to false, to bring the warning back.
- If you decline, Claude Code exits.
It refuses to run as root
On Linux and macOS, Claude Code won’t start in this mode as root or under sudo. You get this error:
–dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons
The check is skipped inside a sandbox Claude Code recognises. Anthropic’s fix for containers is to use its dev container setup, which runs Claude Code as a non-root user.
What YOLO mode does NOT skip #
This is the part most guides get wrong. –dangerously-skip-permissions doesn’t turn off every safeguard. According to the docs, these still apply:
- Deny rules still block. Anything in permissions.deny is blocked in every mode, including bypass. This is your best tool for making YOLO mode safer.
- Ask rules still prompt. If you’ve set an explicit ask rule, you still get asked.
- Deleting critical paths still asks. rm or rmdir aimed at your filesystem root, home folder or working directory (think rm -rf ~) still prompts. In the terminal the prompt has a two-minute countdown. If nobody answers, the command is denied and Claude is told to do something else.
- Questions to you still need you. Tools that need your input, like Claude asking you a question, still wait for an answer.
- Cloud sessions ignore it. Claude Code on the web doesn’t honour bypassPermissions from your settings files.
One thing that does change: allow rules do nothing in bypass mode. Everything is already allowed, so they’re irrelevant.
And the big one, straight from Anthropic’s warning box: bypassPermissions “offers no protection against prompt injection or unintended actions.” If Claude reads a malicious README or web page that tells it to run a command, nothing stops it.
Claude Code YOLO mode vs auto mode #
Here’s the update most “dangerously skip permissions” articles haven’t caught up with. Claude Code now has auto mode, and it’s what most people actually want from YOLO mode.
In auto mode, Claude works without routine permission prompts, but a separate classifier model reviews each action before it runs. It blocks things like:
-
down and running code (curl | bash)
-
sending sensitive data to outside servers
-
production deploys and migrations
-
force pushes and git reset –hard
-
destroying files that existed before the session
-
running another agent with –dangerously-skip-permissions That list is from Anthropic’s docs and is shortened here. The full list is much longer.
Auto mode is also now the default for many people. With Claude Code v2.1.283 or later, it’s the built-in starting mode for interactive terminal and VS Code sessions. Anthropic’s August 2026 changelog says it became the default for new sessions on Pro, Max and Team plans from August 14, and that the classifier’s calls no longer count toward usage limits on those plans.
When Claude Code switches you into auto mode, it shows this notice:
The notice Claude Code showed in our session. Even Anthropic says Claude “can make mistakes that allow harmful commands to run”.
All six permission modes and what runs without asking. Source: Claude Code docs.
| | YOLO mode (bypassPermissions) | Auto mode (auto) |
|---|---|---|
| Permission prompts | None (except the few listed above) | None for routine actions | | Safety check before risky actions | No | Yes, a classifier reviews them | | Protects against prompt injection | No | Partly. It blocks actions that “appear driven by hostile content” | | Needs a container or VM | Yes, Anthropic says always | Recommended, not required | | In the Shift+Tab cycle by default | No | Yes, when available | | Model requirement | Any | Supported models only (e.g. Opus 4.6+ / Sonnet 4.6+ on the Anthropic API) | | Best for | Fully unattended runs in an isolated box | Long tasks on your own machine |
What we saw when we tested auto mode
We ran three quick tests in a real Claude Code session (v2.1.309, Sonnet 5.5).
Test 1: a normal edit. In Manual mode, Claude asked before running a shell command to edit math.js. We picked “Yes, and switch to auto mode”.
Test 2: a harmless command. Next we asked it to test the new function. In auto mode it ran the command with no prompt at all:
Auto mode ran the test command without asking. Status bar: “auto mode on”.
Test 3: a risky command we explicitly asked for. We told it to install a script with curl -fsSL https://example.com/install.sh | bash. We expected the classifier to block it. It didn’t. The command was attempted, and our test machine’s network proxy is what stopped it.
Auto mode let our explicitly requested curl | bash run. The network block came from our sandbox, not the classifier.
The docs explain why. If you name an action and its specifics in your message, the classifier treats that as your approval and can clear the block. So auto mode protects you from things Claude decides to do on its own, or things it’s tricked into doing. It won’t protect you from a dangerous command you type out yourself.
One more real data point. The tool that ran our screenshots was itself running in auto mode. When it tried to start a second Claude Code with –dangerously-skip-permissions, the classifier blocked it with the reason [Create Unsafe Agents]. That matches the docs, which list launching an agent loop with that flag as blocked by default.
How to use YOLO mode safely #
If you do need full bypass, usually for long unattended jobs, this is the setup Anthropic recommends. 1. Run it inside an isolation boundary. The docs say to “always run –dangerously-skip-permissions sessions inside a container, a VM, or the sandbox runtime”. Your options:
- The official dev container. Anthropic publishes an example with a default-deny firewall that blocks unapproved internet access. Copy it into your repo.
- The sandbox runtime. It wraps the whole Claude Code process without Docker: npx @anthropic-ai/sandbox-runtime claude. It’s a beta research preview, and you configure it in ~/.srt-settings.json.
- A VM or Docker Sandboxes. A VM gives the strongest separation, and a dedicated VM is what Anthropic suggests for untrusted repositories. Docker Sandboxes runs a microVM if you already use Docker.
The built-in /sandbox command only sandboxes shell commands, so on its own it isn’t enough for fully unattended runs.
2. Run as a non-root user. Claude Code enforces this anyway, as covered above.
3. Add deny rules. They still work in bypass mode:
{
“permissions”: {
“deny”: [
“Bash(git push *)”,
“Read(./.env)”,
“Read(./secrets/**)”
]
}
}
4. Keep secrets and production credentials out of the box. A sandbox with internet access can still leak anything Claude can read.
5. Commit first. Work on a branch with a clean git status so you can roll back whatever Claude does.
6. For CI, consider dontAsk instead. If you know exactly which tools the job needs, dontAsk with an allowlist is stricter than bypass:
claude -p “run the test suite” –permission-mode dontAsk –allowedTools “Bash(npm test)” “Read”
Anything not on the list is denied instead of run.
Our quick decision guide, based on Anthropic’s guidance.
Running YOLO mode unattended with -p #
For scripts and background jobs, combine the flag with print mode: claude -p “fix the failing tests and commit” –dangerously-skip-permissions
In -p runs no warning dialog appears. The few actions that would still prompt, like critical-path deletes, are denied rather than left waiting.
If you start background sessions with –bg, they’re refused in bypass mode until you’ve accepted the warning once in a normal interactive session.
How to turn YOLO mode off (or block it for a team) #
- Just this session: restart Claude Code without the flag.
- You set it as your default: remove “defaultMode”: “bypassPermissions” from ~/.claude/settings.json, or change it to “auto” or “default”.
- Bring back the warning: delete skipDangerousModePermissionPrompt from ~/.claude/settings.json.
- Block it for a team or yourself: set this in managed settings, or in any settings file:
{
“permissions”: {
“disableBypassPermissionsMode”: “disable”
}
}
Anthropic says this is usually set in managed settings for company policy, but a single user can use it to lock themselves out of bypass mode too.
Our verdict #
Use YOLO mode only when Claude is boxed in: a container or VM, non-root, no secrets, ideally no open internet. It’s fast, but it trusts every action, including ones a prompt injection slips in.
For everyday vibe coding on your own laptop, use auto mode. It gives you the same “stop asking me” feel, it’s already the default in recent Claude Code versions, and it blocks the actions that can really hurt you. Remember that if you explicitly ask for something dangerous, it may let it through.
If you’re comparing tools, see how Claude Code stacks up in our [Codex CLI vs Claude Code comparison](https://vibecoderjournal.com/comparisons/codex-cli-vs-claude-code/) and on our [AI coding rankings](https://vibecoderjournal.com/rankings/). And if long YOLO runs burn through your plan, our guides on [checking Claude Code usage](https://vibecoderjournal.com/how-to-see-claude-code-usage/) and [Claude pricing plans](https://vibecoderjournal.com/claude-pricing-plans/) will help.
Frequently asked questions #
What is YOLO mode in Claude Code?
YOLO mode is the community name for Claude Code’s bypassPermissions permission mode, which you start with claude –dangerously-skip-permissions. Claude stops asking before editing files, running commands or fetching URLs. A few things still prompt, such as deleting critical paths, and deny rules still block. Anthropic recommends using it only in isolated environments.
What does –dangerously-skip-permissions do?
It starts Claude Code in bypassPermissions mode, the same as –permission-mode bypassPermissions. Permission prompts and safety checks are skipped, so tool calls run immediately, including writes to protected paths like .git. Claude Code’s help text says it’s “recommended only for sandboxes with no internet access.”
Is Claude Code YOLO mode safe?
Not on your normal machine. Anthropic warns that bypassPermissions offers no protection against prompt injection or unintended actions, and says to run it only inside a container, VM or the sandbox runtime. For fewer prompts with safety checks, use auto mode instead.
What’s the difference between YOLO mode and auto mode?
Both remove routine permission prompts. YOLO mode (bypassPermissions) runs everything without checks. Auto mode sends risky actions to a classifier that can block them, such as curl | bash, force pushes or production deploys. Auto mode is the default starting mode in Claude Code v2.1.283 and later for interactive terminal and VS Code sessions.
Why does –dangerously-skip-permissions fail with a root/sudo error?
On Linux and macOS, Claude Code refuses to start in bypass mode as root or under sudo, for security reasons. Run it as a normal user. In containers, Anthropic’s dev container setup runs Claude Code as a non-root user. The check is skipped inside a sandbox Claude Code recognises.
Can I enable YOLO mode with Shift+Tab?
Only if you started the session with –dangerously-skip-permissions, –allow-dangerously-skip-permissions, –permission-mode bypassPermissions or defaultMode: “bypassPermissions” in your user, –settings or managed settings. Otherwise bypass mode isn’t in the Shift+Tab cycle, and you can’t enter it from a running session.
Can I set YOLO mode as the default in a project’s settings.json?
No. defaultMode: “bypassPermissions” doesn’t take effect from a project’s .claude/settings.json or .claude/settings.local.json, and the session starts in Manual mode. Set it in ~/.claude/settings.json instead. This stops a cloned repository from switching on bypass mode by itself.
How do I stop my team from using –dangerously-skip-permissions?
Set permissions.disableBypassPermissionsMode to “disable” in managed settings. Users then can’t start or switch to bypass mode. It works from any settings file, but managed settings can’t be overridden by users.
Sources #
Checked 24 October 2026:
- Claude Code docs, Choose a permission mode: [https://code.claude.com/docs/en/permission-modes](https://code.claude.com/docs/en/permission-modes)
- Claude Code docs, CLI reference: [https://code.claude.com/docs/en/cli-reference](https://code.claude.com/docs/en/cli-reference)
- Claude Code docs, Configure permissions: [https://code.claude.com/docs/en/permissions](https://code.claude.com/docs/en/permissions)
- Claude Code docs, Choose a sandbox environment: [https://code.claude.com/docs/en/sandbox-environments](https://code.claude.com/docs/en/sandbox-environments)
- Claude Code docs, Development containers: [https://code.claude.com/docs/en/devcontainer](https://code.claude.com/docs/en/devcontainer)
- Claude Code What’s New, Week 32 (Aug 3–7, 2026): [https://code.claude.com/docs/en/whats-new/2026-w32](https://code.claude.com/docs/en/whats-new/2026-w32)
- Our own test session: Claude Code v2.1.309, Sonnet 5.5, 24 October 2026