{"slug": "how-to-run-claude-code-in-full-auto-mode-on-macos-without-risking-your-files-or", "title": "How to run Claude Code in full-auto mode on macOS without risking your files or keys", "summary": "A MacVisor guide details how to run Anthropic's Claude Code in full-auto mode on macOS by using a throwaway Linux VM sandbox, keeping the `--dangerously-skip-permissions` flag's risks off the host machine. The guide requires an Apple Silicon Mac running macOS 27 and a project in a git repository, and notes AI sandboxes are a Tech Preview; the Anthropic API key stays in the Mac's Keychain and is added to each request as it leaves the Mac, so the VM never sees it. The workflow creates a sandbox in about a minute with a `pristine` checkpoint, restricts egress to approved sites such as npm, github, pypi, ubuntu and homebrew, and applies reviewed changes all-or-nothing without committing.", "body_md": "Claude Code works best when it doesn't stop to ask. Give it a task and it runs the tests, installs what it needs and tries again until it's done. That's what `--dangerously-skip-permissions` turns on, and the flag's name tells you the catch.\n\nAnthropic's docs say to use it only inside a [container or a VM](https://code.claude.com/docs/en/sandbox-environments). This guide shows the simplest way to do that on a Mac: a [MacVisor AI sandbox](https://scaleninja.com/macvisor/ai-sandboxes/claude-code/), a throwaway VM made for the job.\n\n## What's at risk\n\nWith prompts off, Claude Code runs every command it decides to run, as you. On your Mac it can:\n\n- read and change any file your account can, including `~/.ssh` and your other projects\n- read API keys from your shell, `.env` files and config folders\n- reach the internet, your local network and services running on your Mac\n- rewrite git history or push with your credentials\n\nIt doesn't have to be malicious. Mistakes happen, and a README, an issue or a web page can carry text written to steer an agent. With prompts off, the only safety left is where the agent runs.\n\n## Your options\n\n| Option | Good for | Watch out for | \n|---|---|---|\n| Claude Code's `/sandbox` | Everyday work. Built in, nothing to install. | It still runs on your Mac, as you. | \n| A container | Linux-only projects. Light. | Keys usually go in as variables the agent can read. Linux only. | \n| A VM | Full isolation, Linux or macOS, keys kept outside. | Uses more memory. | \n\nFor a Linux-only project with low-stakes keys, a container is often enough. If you want your keys out of reach, need macOS, or want to review every change before it lands, use a VM.\n\n## Run Claude Code in a MacVisor sandbox\n\nYou need an Apple Silicon Mac with macOS 27, and a project in a git repository. AI sandboxes are a Tech Preview.\n\n**1. Store your Anthropic key on the Mac, once.**\n\n```\nmvz ai keys set anthropic\n```\n\nThe key stays in the Mac's Keychain. MacVisor adds it to each request as it leaves the Mac, so the VM never sees it. To use a Claude subscription instead, create the sandbox with `--egress open`, store no key, and sign in inside the VM.\n\n**2. Create the sandbox.**\n\n```\nmvz sandbox create ~/src/app --agent claude\n```\n\nOr click **New AI Sandbox…** in the app. MacVisor makes a Linux VM, copies in your project, installs Claude Code and saves a checkpoint called `pristine`. It takes about a minute. The sandbox is named after the folder, here `app-1`. Add `--os macos` if the work needs macOS or Xcode.\n\n**3. Give it a task.**\n\n```\nmvz sandbox run app-1 -- \"the integration tests fail on the new schema; fix them\"\n```\n\nClaude Code runs with permissions off, inside the VM. To chat with it instead, use `mvz sandbox attach app-1`.\n\n**4. Allow only the sites it needs.**\n\nThe sandbox reaches the models and nothing else until you allow more:\n\n```\nmvz sandbox allow app-1 npm      # or github, pypi, ubuntu, homebrew\nmvz sandbox log app-1 --egress   # what it tried to reach\n```\n\n**5. Review the changes.**\n\n```\nmvz sandbox diff app-1 --patch\n```\n\nThe diff is made on your Mac, with your own git. MacVisor flags changes that could run code later, such as scripts, git hooks, CI files and `.claude/` settings. Read those first.\n\n**6. Apply, or start over.**\n\n```\nmvz sandbox apply app-1               # or --branch for a new branch\nmvz sandbox rollback app-1 pristine   # try another prompt from scratch\nmvz sandbox discard app-1             # done: the VM goes to the Trash\n```\n\n`apply` brings in exactly what you reviewed, all or nothing, and commits nothing.\n\n## Prefer Claude Code on your Mac?\n\nRun `mvz mcp install claude-code`. Claude Code on your Mac can then run commands in sandboxes, read their files, show their diffs and take checkpoints, while its own permission prompts stay on for your Mac. Your other VMs stay hidden from it unless you open one to agents. See [AI agents and MCP](https://scaleninja.com/docs/macvisor/ai-agents/).\n\n## Good to know\n\n- You can use a local model instead of a cloud key: Ollama, LM Studio, llama.cpp or oMLX on the Mac.\n- A Mac runs two macOS VMs at a time, so at most two macOS sandboxes. Linux sandboxes have no such limit.\n- Sandboxes on the allow-list network can reach each other.\n- AI sandboxes are a Tech Preview, so commands may still change.\n\n## Try it free\n\nMacVisor runs Claude Code, Codex, Goose, Aider and OpenCode in sandboxes, next to your macOS, Windows and Linux VMs. It's free for 30 days, then a one-time Pro license, with every single-Mac feature in every license.\n\n[Download MacVisor free](https://scaleninja.com/macvisor/) [See pricing](https://scaleninja.com/macvisor/#pricing)\n\nMore detail: the [Claude Code sandbox guide](https://scaleninja.com/macvisor/ai-sandboxes/claude-code/) and the [AI sandboxes docs](https://scaleninja.com/docs/macvisor/ai-sandboxes/).", "url": "https://wpnews.pro/news/how-to-run-claude-code-in-full-auto-mode-on-macos-without-risking-your-files-or", "canonical_source": "https://scaleninja.com/blog/claude-code-full-auto-sandbox/", "published_at": "2026-11-13 00:00:00+00:00", "updated_at": "2026-11-14 10:51:42.962839+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-safety", "developer-tools"], "entities": ["Anthropic", "Claude Code", "MacVisor", "Apple Silicon", "macOS 27", "Xcode"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/how-to-run-claude-code-in-full-auto-mode-on-macos-without-risking-your-files-or", "markdown": "https://wpnews.pro/news/how-to-run-claude-code-in-full-auto-mode-on-macos-without-risking-your-files-or.md", "text": "https://wpnews.pro/news/how-to-run-claude-code-in-full-auto-mode-on-macos-without-risking-your-files-or.txt", "jsonld": "https://wpnews.pro/news/how-to-run-claude-code-in-full-auto-mode-on-macos-without-risking-your-files-or.jsonld"}}