How to run Claude Code in full-auto mode on macOS without risking your files or keys

A MacVisor guide details how to run Anthropic's Claude Code in full-auto mode on macOS by using a throwaway Linux VM sandbox, keeping the `--dangerously-skip-permissions` flag's risks off the host machine. The guide requires an Apple Silicon Mac running macOS 27 and a project in a git repository, and notes AI sandboxes are a Tech Preview; the Anthropic API key stays in the Mac's Keychain and is added to each request as it leaves the Mac, so the VM never sees it. The workflow creates a sandbox in about a minute with a `pristine` checkpoint, restricts egress to approved sites such as npm, github, pypi, ubuntu and homebrew, and applies reviewed changes all-or-nothing without committing.

Claude Code works best when it doesn't stop to ask. Give it a task and it runs the tests, installs what it needs and tries again until it's done. That's what --dangerously-skip-permissions turns on, and the flag's name tells you the catch. Anthropic's docs say to use it only inside a container or a VM https://code.claude.com/docs/en/sandbox-environments . This guide shows the simplest way to do that on a Mac: a MacVisor AI sandbox https://scaleninja.com/macvisor/ai-sandboxes/claude-code/ , a throwaway VM made for the job. What's at risk With prompts off, Claude Code runs every command it decides to run, as you. On your Mac it can: - read and change any file your account can, including ~/.ssh and your other projects - read API keys from your shell, .env files and config folders - reach the internet, your local network and services running on your Mac - rewrite git history or push with your credentials It doesn't have to be malicious. Mistakes happen, and a README, an issue or a web page can carry text written to steer an agent. With prompts off, the only safety left is where the agent runs. Your options | Option | Good for | Watch out for | |---|---|---| | Claude Code's /sandbox | Everyday work. Built in, nothing to install. | It still runs on your Mac, as you. | | A container | Linux-only projects. Light. | Keys usually go in as variables the agent can read. Linux only. | | A VM | Full isolation, Linux or macOS, keys kept outside. | Uses more memory. | For a Linux-only project with low-stakes keys, a container is often enough. If you want your keys out of reach, need macOS, or want to review every change before it lands, use a VM. Run Claude Code in a MacVisor sandbox You need an Apple Silicon Mac with macOS 27, and a project in a git repository. AI sandboxes are a Tech Preview. 1. Store your Anthropic key on the Mac, once. mvz ai keys set anthropic The key stays in the Mac's Keychain. MacVisor adds it to each request as it leaves the Mac, so the VM never sees it. To use a Claude subscription instead, create the sandbox with --egress open , store no key, and sign in inside the VM. 2. Create the sandbox. mvz sandbox create ~/src/app --agent claude Or click New AI Sandbox… in the app. MacVisor makes a Linux VM, copies in your project, installs Claude Code and saves a checkpoint called pristine . It takes about a minute. The sandbox is named after the folder, here app-1 . Add --os macos if the work needs macOS or Xcode. 3. Give it a task. mvz sandbox run app-1 -- "the integration tests fail on the new schema; fix them" Claude Code runs with permissions off, inside the VM. To chat with it instead, use mvz sandbox attach app-1 . 4. Allow only the sites it needs. The sandbox reaches the models and nothing else until you allow more: mvz sandbox allow app-1 npm or github, pypi, ubuntu, homebrew mvz sandbox log app-1 --egress what it tried to reach 5. Review the changes. mvz sandbox diff app-1 --patch The diff is made on your Mac, with your own git. MacVisor flags changes that could run code later, such as scripts, git hooks, CI files and .claude/ settings. Read those first. 6. Apply, or start over. mvz sandbox apply app-1 or --branch for a new branch mvz sandbox rollback app-1 pristine try another prompt from scratch mvz sandbox discard app-1 done: the VM goes to the Trash apply brings in exactly what you reviewed, all or nothing, and commits nothing. Prefer Claude Code on your Mac? Run mvz mcp install claude-code . Claude Code on your Mac can then run commands in sandboxes, read their files, show their diffs and take checkpoints, while its own permission prompts stay on for your Mac. Your other VMs stay hidden from it unless you open one to agents. See AI agents and MCP https://scaleninja.com/docs/macvisor/ai-agents/ . Good to know - You can use a local model instead of a cloud key: Ollama, LM Studio, llama.cpp or oMLX on the Mac. - A Mac runs two macOS VMs at a time, so at most two macOS sandboxes. Linux sandboxes have no such limit. - Sandboxes on the allow-list network can reach each other. - AI sandboxes are a Tech Preview, so commands may still change. Try it free MacVisor runs Claude Code, Codex, Goose, Aider and OpenCode in sandboxes, next to your macOS, Windows and Linux VMs. It's free for 30 days, then a one-time Pro license, with every single-Mac feature in every license. Download MacVisor free https://scaleninja.com/macvisor/ See pricing https://scaleninja.com/macvisor/ pricing More detail: the Claude Code sandbox guide https://scaleninja.com/macvisor/ai-sandboxes/claude-code/ and the AI sandboxes docs https://scaleninja.com/docs/macvisor/ai-sandboxes/ .