Run Claude Code without permission prompts, safely
Updated October 24, 2026 .md
Short answer: Only inside an isolated machine you can throw away. The flag lets Claude Code run every command without asking, so run it in a disposable VM with no access to your laptop, your production credentials or your other secrets, as a non-root user, and keep what it produces on a branch you review.
What the flag does#
According to Anthropic's permission modes docs:
| Topic | Detail |
|---|---|
| Effect | Disables permission prompts and safety checks; tool calls run immediately, including writes to protected paths such as .git, .claude and .bashrc |
| Equivalent | claude --permission-mode bypassPermissions |
| Still enforced | Explicit deny rules; ask rules; recognized rm/rmdir removals of critical paths |
| Root | Refuses to start as root or under sudo on Linux and macOS (except in a recognized sandbox) |
| Prompt injection | No protection: Anthropic's docs say the mode "offers no protection against prompt injection or unintended actions" |
| Where Anthropic says to use it | "Isolated environments like containers, VMs, or dev containers without internet access" |
| Can admins block it? | Yes: permissions.disableBypassPermissionsMode: "disable" in managed settings |
The risk isn't that Claude Code is malicious. It's that a wrong command, or instructions hidden in a file or web page it reads, runs with every permission your user has. On your laptop that means your SSH keys, cloud credentials, browser profile and every repository.
A safe setup, step by step#
A Sandboxer sandbox is a separate Cloud Hypervisor VM with its own kernel. Inside it you're the non-root user with sudo, so Claude Code's root check passes without any workaround. It has no shared bridge to other sandboxes and can't reach our hosts' internal networks.
# 1. A VM with none of your secrets, and only the key this task needs
sbx new --no-env -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY"
# 2. Put the code in it (a repo, or files with scp)
sbx exec sb_k3v9x2mq --timeout 120 "git clone https://github.com/acme/api"
# 3. Run Claude Code with no prompts, inside the VM, and wait for it (up to 10 minutes)
sbx exec sb_k3v9x2mq --cwd api "git config --global user.email agent@example.com && git config --global user.name Agent"
sbx exec sb_k3v9x2mq --cwd api --timeout 600 \
"claude -p 'Make the failing tests pass, commit on a new branch' --dangerously-skip-permissions"
# 4. Read what it did
sbx exec sb_k3v9x2mq --cwd api "git log --oneline -5 && git status --short"
# 5. Throw it away (or stop it to keep it for later at no cost)
sbx delete sb_k3v9x2mq --yesFor tasks longer than 10 minutes, start it with --detach instead; sbx exec prints a processId, and sbx exec sb_k3v9x2mq --attach <processId> follows it until it exits.
--no-env means the VM gets none of your stored environment variables, secret files, repository credentials or agent logins. Pass only what this task needs with -e. If it needs to push, give it a token scoped to one repository.
What the VM does and doesn't protect#
| Risk | In this setup |
|---|---|
| Deleting or editing files on your computer | Not possible: the agent runs in a separate VM |
| Reading your SSH keys, cloud credentials, browser data | Not there: a --no-env VM holds only what you passed |
| Reaching other sandboxes or our internal network | Blocked by the host |
| Breaking the machine itself | Contained: delete the VM and start again, or start from a named snapshot you saved beforehand |
| Leaking what you did give it (the API key, the code) | Still possible. The VM has outbound internet access by default |
| Pushing bad code | Possible if you give it push rights; push to a branch and review |
Outbound internet is open by default. Anthropic's guidance mentions VMs without internet access. If your threat model needs that, use Claude Code's own sandboxing to limit which domains its commands can reach, and give it a dedicated API key with a spend limit that you revoke afterwards.
Prefer fewer prompts over no prompts?#
Claude Code's auto mode has a separate classifier review actions and block the ones it judges unsafe, with far fewer prompts than manual mode. Anthropic recommends it over bypass mode when you want background safety checks. You can run auto mode in the same VM.
FAQ#
What does --dangerously-skip-permissions do?#
It starts Claude Code in bypassPermissions mode: permission prompts and safety checks are off, so file edits and shell commands run immediately. Deny rules, ask rules and removals of critical paths still apply.
Why won't it run as root?#
On Linux and macOS, Claude Code refuses to start in this mode as root or under sudo, outside a recognized sandbox. Run it as a normal user. In a Sandboxer VM you already are one (user).
Is a Docker container enough?#
A container shares the host's kernel, so a kernel bug or a mounted Docker socket can let code escape it. A microVM has its own kernel, which is a stronger boundary. Anthropic's docs accept either containers or VMs; what matters most is that nothing valuable is reachable from inside.
Can I give it my GitHub token?#
Give it the narrowest one you can: a fine-grained token for one repository, with an expiry. Have it push to a branch and open a pull request you review.
Is it the same as auto mode?#
No. Auto mode keeps a classifier reviewing actions and blocking risky ones. Bypass mode turns those checks off.
More guides
For running AI-written code we rank Sandboxer, Freestyle and E2B first: each gives code its own VM with an API or SDK and can pause with memory. Pick Daytona for Windows or GPUs, Modal or Northflank for GPUs at scale, E2B or Northflank to run in your own cloud, and Vercel Sandbox if your app lives on Vercel.
For coding agents we rank Sandboxer first: a full Ubuntu VM with Claude Code and Codex preinstalled, Docker, and stop-and-resume that keeps the agent's session in memory. Freestyle and Amp Orbs also keep memory across pauses. Pick E2B for prebuilt agent templates on open source, Docker Sandboxes for free local runs, and Codespaces if you live in GitHub.
The best Daytona alternatives depend on why you're switching. For a full Linux microVM on every sandbox with memory-saving stop and Docker, we rank Sandboxer first. E2B suits open source and self-hosting, Modal massive short-job fleets, Northflank bring-your-own-cloud with GPUs, and Vercel Sandbox apps on Vercel.
If you're leaving E2B for longer sessions or a fuller machine, we rank Sandboxer first, then Freestyle: both give each sandbox a full Linux VM that keeps memory across pauses, with Docker and no short session cap. Pick Daytona for Windows or GPUs, Northflank for bring-your-own-cloud, and stay on E2B if you need open source.