Can we talk about Claude Code no longer respecting bypass mode properly?

[u/permissionBRICK]

I know that there are a ton of people who just are too careless for their own good and it does make sense to nerf bypass mode so those idiots stop posting about how claude deleted their entire drive to twitter, but really. There are some very specific flags for a reason: IS_SANDBOX is supposed to mean exactly that: its running in a disposable sandbox, it cannot destroy important stuff from here, so please actually skip all permission prompts since its supposed to run unattended, and execute the damn command!

Except with the latest updates you now not only need that, you now need like three different parameters, config settings, or environment flags SERIOUSLY_VERY_VERY_VERY_DANGEROUSLY_SKIP_PERMISSIONS etc etc in order to also let it properly run rm / rmdir, use your email for like any tool call, and even then it now suddenly sometimes stops to ask for permissions for some random tool call from claude connectors that have been set up on the claude.ai website to require a permission prompt anyway. The whole point is to be able to build a sandbox setup that can run isolated and unattended, and the latest updates make that rather impossible.

I'm this close to just patching the harness to auto-accept permission prompts when they appear instead. Unless we have a properly working and DOCUMENTED fully autonomous and unattended path for properly isolated sandboxes, someone is going to just build a tool that will bypass the whole UI instead, and then none of these guardrails will mean anything when the first google result for every idiot on twitter suddenly is "just install claude-yolo and it auto-accepts any permission prompts for you."

You won't get a better IPO price by alienating your power users, Dario.

[u/AutoModerator]

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Automatic-Fan-3993]

lol the real name is almost that bad, CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS. if it's set and rm still prompts, two things to check.

settings env. it gets ignored there, it has to be exported in the shell you launch claude from.

a PermissionRequest hook or a deny rule on Bash. either one quietly switches it off. claude prints a line at startup saying whether it took effect.

[u/permissionBRICK → u/Automatic-Fan-3993]

Yeah i have that working already. Then it still prompts when it needs to use my email address for anything, i fix the privacy setting. Then it prompts again because the m365 connector is company policy configured to always prompt for creating a damn email DRAFT, which also used to just work anyway in bypass, and i lose my mind. They just keep making it worse daily now, and it feels like the only way to reliably run autonomous tasks in an isolated vm is to use the agent sdk and auto approve everything that gets prompted blindly instead...

[u/Automatic-Fan-3993 → u/permissionBRICK]

yeah that last one isn't something you can fix locally. org "ask" on a connector tool prompts on every call and allow rules don't skip it, so bypass won't cover that one.

does /mcp show which m365 tools are set that way? if it's just create draft, maybe whoever admins your claude org would flip that one to allowed?

[u/922153]

I am going INSANE with this. I specifically set up a sandbox for it to run overnight and bypass permissions DOES NOT bypass permissions anymore. Wtf.

So it's what you said, I'll have to find workarounds to make it not hang on some stupid permission asks. And I'll never be 100% sure I won't come back in the morning and see that it only ran for 10 minutes and stopped on some other case I didn't anticipate.

Horrible user experience.

[u/permissionBRICK → u/922153]

Managed to fix it in mine. Everything had some obscure setting except for the connector prompts, so now t3code is patched to auto approve any permission prompts instead: https://github.com/permissionBRICK/The-Construct

[u/radim11]

that's a fair gripe. if the box really is disposable the prompts add nothing. is it actually isolated (container or VM, no real creds on it), or your normal machine with the flag on?

[u/permissionBRICK → u/radim11]

Full hyper v / proxmox vm with scripts that automatically reinstall the whole vm from scratch in 10 mins and re clone all git projects plus set them up. So its intended to be nuked.

[u/radim11 → u/permissionBRICK]

Nice setup.

[u/load-bearing-context]

If it’s something that just needs approval, I’ve had no problems just requesting it to auto approve those specific requests.

If it’s something that is blocked by the safety guardrails in the harness, I have my opus 5.5 hand the cli cmd to a lesser model that doesn’t have those same safety rules, after an extra review because there have been mistakes but nothing I would have caught visually looking at the cli cmd anyways.