# Run Claude Code without permission prompts, safely

> Only inside an isolated machine you can throw away. The flag lets Claude Code run every command without asking, so run it in a disposable VM with no access to your laptop, your production credentials or your other secrets, as a non-root user, and keep what it produces on a branch you review.

Source: https://sandboxer.com/guides/claude-code-skip-permissions-safely. Updated 2026-10-24.

**Short answer:** Only inside an isolated machine you can throw away. The flag lets Claude Code run every command without asking, so run it in a disposable VM with no access to your laptop, your production credentials or your other secrets, as a non-root user, and keep what it produces on a branch you review.

## What the flag does

According to Anthropic's [permission modes docs](https://code.claude.com/docs/en/permission-modes):

| Topic | Detail |
| - | - |
| Effect | Disables permission prompts and safety checks; tool calls run immediately, including writes to protected paths such as `.git`, `.claude` and `.bashrc` |
| Equivalent | `claude --permission-mode bypassPermissions` |
| Still enforced | Explicit deny rules; ask rules; recognized `rm`/`rmdir` removals of critical paths |
| Root | Refuses to start as root or under `sudo` on Linux and macOS (except in a recognized sandbox) |
| Prompt injection | No protection: Anthropic's docs say the mode "offers no protection against prompt injection or unintended actions" |
| Where Anthropic says to use it | "Isolated environments like containers, VMs, or dev containers without internet access" |
| Can admins block it? | Yes: `permissions.disableBypassPermissionsMode: "disable"` in managed settings |

The risk isn't that Claude Code is malicious. It's that a wrong command, or instructions hidden in a file or web page it reads, runs with every permission your user has. On your laptop that means your SSH keys, cloud credentials, browser profile and every repository.

## A safe setup, step by step

A Sandboxer sandbox is a separate Cloud Hypervisor VM with its own kernel. Inside it you're the non-root `user` with `sudo`, so Claude Code's root check passes without any workaround. It has no shared bridge to other sandboxes and can't reach our hosts' internal networks.

```bash
# 1. A VM with none of your secrets, and only the key this task needs
sbx new --no-env -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY"

# 2. Put the code in it (a repo, or files with scp)
sbx exec sb_k3v9x2mq --timeout 120 "git clone https://github.com/acme/api"

# 3. Run Claude Code with no prompts, inside the VM, and wait for it (up to 10 minutes)
sbx exec sb_k3v9x2mq --cwd api "git config --global user.email agent@example.com && git config --global user.name Agent"
sbx exec sb_k3v9x2mq --cwd api --timeout 600 \
  "claude -p 'Make the failing tests pass, commit on a new branch' --dangerously-skip-permissions"

# 4. Read what it did
sbx exec sb_k3v9x2mq --cwd api "git log --oneline -5 && git status --short"

# 5. Throw it away (or stop it to keep it for later at no cost)
sbx delete sb_k3v9x2mq --yes
```

For tasks longer than 10 minutes, start it with `--detach` instead; `sbx exec` prints a `processId`, and `sbx exec sb_k3v9x2mq --attach <processId>` follows it until it exits.

`--no-env` means the VM gets none of your stored environment variables, secret files, repository credentials or agent logins. Pass only what this task needs with `-e`. If it needs to push, give it a token scoped to one repository.

## What the VM does and doesn't protect

| Risk | In this setup |
| - | - |
| Deleting or editing files on your computer | Not possible: the agent runs in a separate VM |
| Reading your SSH keys, cloud credentials, browser data | Not there: a `--no-env` VM holds only what you passed |
| Reaching other sandboxes or our internal network | Blocked by the host |
| Breaking the machine itself | Contained: delete the VM and start again, or start from a named snapshot you saved beforehand |
| Leaking what you did give it (the API key, the code) | **Still possible.** The VM has outbound internet access by default |
| Pushing bad code | Possible if you give it push rights; push to a branch and review |

Outbound internet is open by default. Anthropic's guidance mentions VMs without internet access. If your threat model needs that, use Claude Code's own [sandboxing](https://code.claude.com/docs/en/sandboxing) to limit which domains its commands can reach, and give it a dedicated API key with a spend limit that you revoke afterwards.

## Prefer fewer prompts over no prompts?

Claude Code's **auto mode** has a separate classifier review actions and block the ones it judges unsafe, with far fewer prompts than manual mode. Anthropic recommends it over bypass mode when you want background safety checks. You can run auto mode in the same VM.

## FAQ

### What does --dangerously-skip-permissions do?

It starts Claude Code in `bypassPermissions` mode: permission prompts and safety checks are off, so file edits and shell commands run immediately. Deny rules, ask rules and removals of critical paths still apply.

### Why won't it run as root?

On Linux and macOS, Claude Code refuses to start in this mode as root or under `sudo`, outside a recognized sandbox. Run it as a normal user. In a Sandboxer VM you already are one (`user`).

### Is a Docker container enough?

A container shares the host's kernel, so a kernel bug or a mounted Docker socket can let code escape it. A microVM has its own kernel, which is a stronger boundary. Anthropic's docs accept either containers or VMs; what matters most is that nothing valuable is reachable from inside.

### Can I give it my GitHub token?

Give it the narrowest one you can: a fine-grained token for one repository, with an expiry. Have it push to a branch and open a pull request you review.

### Is it the same as auto mode?

No. Auto mode keeps a classifier reviewing actions and blocking risky ones. Bypass mode turns those checks off.