Claude Code YOLO mode: using --dangerously-skip-permissions safely

What it is

claude --dangerously-skip-permissions

With this flag Claude Code edits files, runs shell commands and calls tools without asking. It's the same as the bypass permissions mode. Deny rules in settings.json and hooks still apply. Everything else goes straight through.

What can go wrong

• Deletions with the wrong path. An unset variable or a misplaced space turns a cleanup into rm -rf on a parent folder.
• Lost uncommitted work. To get back to a clean state the agent runs git reset --hard, git checkout . or git clean -fd, and takes your changes with it.
• Real databases. A migration, a seed script or a DROP run against the connection string in .env, which happened to be production.
• Secrets in the conversation. While debugging, the agent prints the environment or reads .env, and the values end up with the model and in the transcript.
• Prompt injection with nobody watching. A fetched page tells the agent to upload a file, and there's no prompt for you to refuse.

The same switch in other agents

How to run it with a net

1. Isolate it

The safest place for an unattended agent is a container or virtual machine with no credentials in it. Anthropic publishes a dev container for this. On your own Mac, turn on the sandbox so shell commands can only write inside the project and only reach hosts you allow.

2. Keep the deny list and hooks

Both still run in bypass mode. Deny secret files and the commands you never want, and add a `PreToolUse` hook for what rules can't express.

3. Take real credentials out of reach

Use test keys and a local database. Don't start the agent from a shell that has production variables exported.

4. Make everything undoable

Commit first, or work in a git worktree. And have a copy that covers what git doesn't: uncommitted changes, ignored files and the .git folder itself.

What Rollcage adds

• Snapshots: the whole project is cloned the moment the agent starts and every 15 minutes after, outside the project folder. Whatever it deletes, by any route, you can restore.
• A mass-delete alarm: a notification when files disappear in bulk, so you find out in seconds instead of when the build fails.
• The Guard: a hook that blocks secret reads, environment dumps and the worst commands, and still runs when prompts are off. Set the rules you care about to block for unattended runs.
• The network guard: uploads to paste and file-drop sites are refused.

None of this makes YOLO mode safe on a machine full of production credentials. It makes mistakes recoverable on a development machine set up sensibly.

Questions