The `--dangerously-skip-permissions` flag does exactly what it says. It bypasses every guardrail and runs commands without asking you. Some guides I’ve seen stress that you should only ever run it in a sandboxed environment with no important data Claude Code dangerously-skip-permissions: Safe Usage Guide[1].

Treat each agent like a non human identity, give it just enough privilege to perform its task and monitor its behavior Best Practices for Mitigating the Security Risks of Agentic AI [2].

I go even further. I never let an AI agent delete anything on its own. If it wants to clean up a directory, I read the command and run it myself. It's tedious, BUT it prevents disasters.

ALSO there are emerging frameworks for safe deployment of AI agents that focus on visibility and risk mitigation.

It's early days... but it's better than YOLO-ing with a flag that literally has 'dangerously' in its name.

[1] https://www.ksred.com/claude-code-dangerously-skip-permissio...

[2] https://preyproject.com/blog/mitigating-agentic-ai-security-...

Those who don’t know history are doomed to repeat it. Those who know history are doomed to know that it’s repeating. It’s a personal hell that I’m in. Pull up a chair.

One can go crazy with it a bit, using zsh chpwd, so a sandbox is created upon entry into a project directory and disposed of upon exit. That way one doesn't have to _think_ about sandboxing something.

Also "cat". Because I've had to change a few passwords after .env snuck in there a couple times.

Also giving general access to a folder, even for the session.

Also when working on the homelab network it likes to prioritize disconnecting itself from the internet before a lot of other critical tasks in the TODO list, so it screws up the session while I rebuild the network.

Also... ok maybe I've started backing off from the sun.

I love to use these advanced models but these horror stories are not surprising

Consider cases like these to be canaries in the coal mine. Even if you're operating with enough wisdom and experience to avoid this particular mistake, a dangerous prompt might appear more innocuous, or you may accidentally ingest malicious files that instruct the agent to break your system.

No LLM needed.

It still boggles my mind that people give them any autonomy, as soon as I look away for a second Claude is doing something stupid and needs to be corrected. Every single time, almost like it knows...

- Cleanup or deletion tasks. Be ready to hit ctrl c anytime. Led to disastrous nukes in two reddit threads.

- Errors impacting the whole repo, especially those that are difficult to solve. In such cases if it decides to reset and redo, it may remove sensitive paths as well.

It removed my repo once because "it had multiple problems and was better to it write from scratch".

- Any weird behavior, "this doesn't seem right", "looks like shell isn't working correctly" indicative of application bug. It might employ dangerous workarounds.

But this person was "cleaning up" files using an LLM, something that raises red flags in my brain. That is definitely not an "LLM job" in my head. Perhaps the reason I survived for so long has to do with avoiding batch file operations and focusing on code refractors and integrations.

I have a few VMs that I can rebuild trivially. They only have the relevant repo on them. They basically only run Claude in yolo mode.

I do wish I could use yolo mode, but deny git push or git push —force.

The biggest risk I have using yolo mode is a git push —force to wipe out my remote repo, or a data exfiltration.

I ssh in on my phone/tablet into a tmux session. Each box also has the ability to have an independent environment, which I can access from wherever I’m sshing from.

All in all, I’m pretty happy with the whole situation.

Not too sure of the technical details but Claude Code will very rarely, but can lose track of current directory state which causing issues with deleting. Nothing that git can't solve if its versioned.

Claude once managed to edit code when in planning mode which is interesting, although I didn't manage to reproduce it.

I have written a tool to easily run the agents inside a container that mounts only the current directory.

https://docs.docker.com/ai/sandboxes/

When that token expired I didn't have the patience to go through it again. Using an API key looked like it would be easier.

If this is of interest to anyone else, I filed an issue that has so far gone unacknowledged. Their ticket bot tried to auto-close it after 30 days which I find obnoxious. https://github.com/anthropics/claude-code/issues/9102#issuec...

Some men get all the fun...

It should clearly ask for separate permissions if needs to have elevated access as in what it needs to do.

Also what’s with password pop-ups on Macs? I find that unnerving. Those plain password entry pop-ups with zero info that just tells you an app needs to do something more serious - but what’s that serious thing you don’t know. You just enter your password (I guess sometimes Touch ID as well) and hope all is well. Hell not sure many of you know that pop-up is actually an OS pop-up and not that app or some other app trying to get your password in plaintext.

They’d rather fuck you and the devs over with signing and notarising shenanigans for absolute control hiding behind safety while doing jack about it in reality.

I am a mobile dev (so please know that I have written the above totally from an annoyed and confused, definitely not an expert, end user pov). But what I have mentioned above is too much to ask on a Mac/desktop? ie give an app specific, with well spelt limits, multiple separate permissions as it needs them — no more “enter the password in that nondescript popup and now the app can do everything everywhere or too many things in too many places” as it pleases. Maybe just remove the flow altogether where an app can even trigger that “enter password to allow me go on god or semi-god” mode.

Or maybe it's just fake. It's probably easy Reddit clout to post this kind of thing.

People are really ignorant when it comes to the safeguards that you can put in place for AI. If it's running on your computer and can run arbitrary commands, it can wipe your disk, that's it.

This is comedy gold. If I didn't know better I'd say you hurt Claude in a previous session and it saw its opportunity to get you back.

Really not much evidence at all this actually happened, I call BS.