6 months ago: get Claude to do some work, have GPT review it, ask Claude to first verify findings before actioning.
Now: get GPT to do some work, have Claude review it, question Claude about a finding that is surprising to me because I thought the functionality was already in place.
[Claude/Opus 5 Max goes looking] "You're right — I was wrong about that."
Our Claude license ends in about 2 weeks and we're not renewing - this has been par for the course for the last 2 months now.
And their marketing is really starting to bother me, on top of that.
I'm apparently from the very small faction of users who's been running `--dangerously-skip-permissions` in every instance of Claude for the last year. It's almost a reflex to me. For the most part Claude behaves well, but I don't blindly trust it. LLMs are inherently dangerous tools, and reviewing individual commands (or spamming `y`) doesn't make them less so. Safety is the responsibility of the developer putting sane guardrails (like VCS, immutable filesystems, or read-only tokens). Using more Claude to categorize the safety of Claude commands is not the answer.
I manually approve everything (aside from the "allow commands like this" option). Not because I'm worried it's about to do something harmful but because I want to stop it from wasting tokens doing something stupid like implementing a feature I never asked ask for. I'm not even reading the commands, just checking it's going in vaguely the right direction.
I think my ideal setup would not involve approving commands, but approving summaries of proposed actions (whether they involve code exec or file edits). Kinda like plan mode but perpetual. Like most things, trying to solve it via CLAUDE.md is an exercise in futility.
I'm also in yolo mode, this is the only mode that makes sense for me, if I need to babysit I might as well do it myself.
I run it in a VM so it can install any software needed, yes, there is a risk of escaping, but I'm not giving it impossible tasks so there is no need for it to workaround the jail.
I think all of Anthropic's own staff use --dangerously else they'd work on the usability of the massively imperfect 1-approve-once and 2-approve-forever multi-choice and outcome.
I too skip all permissions, but I run the harnesses inside an isolated virtual machine. I took care to firejail Claude Code on my host since day one, and coding my own QEMU VM orchestration solution was among the first things I used it for.
Alarm fatigue will quickly destroy any and all "meticulously approve every little command the AI wants to run" workflows. Give it a virtual machine and let it cook. If it blows up the virtual machine while it works, it doesn't matter.
I haven't (and won't) gone that far, but what's been working for me is denying all arbitrary code execution, grep, glob etc, and then allowing the JetBrains MCP. At least that way it's essentially locked down to the IDE project.
Then you can treat most asks as a signal something has gone wrong. For the most part it seems to work well within that box.
My .bashrc has `alias claude='claude --dangerously-skip-permissions'`
Been using it like that everyday for about a year now and nothing bad has happened. I got backups and if it would fuck things up, it can probably fix it again as well.
I use dontAsk mode[0] with read access to the entire file system, write access to files from the working directory[1], some git commands (git commit yes, git push no), and a script wrapping Deno with the same read/write permissions (safer substitute for `python -c`).
These are usually enough for most of my coding tasks. In my experience, Claude has been good enough that it can write code and fix bugs without needing anything else. It's far better than ever needing to approve permission requests.
You can just use hooks to physically (so to speak) prevent it from running the most sensitive commands. I find that peace of mind enough for me. E.G. no deletes, no deploying to <env>, etc etc
Everything else you can sort of review what it did after the fact and/or tolerate mistakes, but knowing some thing’s are impossible for it to do us good peace of mind
Otherwise not sure who’d be willing to tediously on every single action on anything but the most important of projects, of which I can’t really think of any of that clear that bar for me
tl;dr: if I run claude/harness inside "code" at "~/<some path>/work/code", it would be great if the harness can't even see "code" is inside "work" (and even I can't make it know that by some quick "Yes(y)")
I want something like: claude/opencode/pi/etc has no existence or capacity outside a file access boundary, say a given folder that (e.g.) lies here "~/<some path>/code". Even if I want, I can't run claude outside it, because it isn't installed outside it. Even if Claude wants it can't read/write/execute/install anything outside it.
Basically I want the harness(es) and my code folder(s) sandboxed [0] inside just one folder and below it in folder hierarchy at least for file access limitations.
Will this pose the challenge of using the system wide cli tools like ls, cd, git et cetera? If it gets a handle on those tools outside that sandboxed folder then pretty much can it execute it in any other folder? So should those tools also be part of that container?
I guess something like docker does that, but do I necessarily need a docker like app/tool? It will use a lot of system resources on its own. A different mac login won't be great either.
I do not want to use claude's /sandbox (or something like this), that will defeat the purpose. Because it's not about "it won't", but because "it can't".
https://github.com/apple/containerization doesn't sound like what I am looking for. So is docker, lima etc are my only options? Not to mention I will lose access to a lot of cli tools I use on mac.
I do the same. I also use crush/deepseek a lot. I patched crush to remove all safetyguards and enable yolo mode by default. I use it on a daily basis including devops. For example to configure netapp storage systems and had not a single incident. Of course I also have backups of my systems and have everything under revision control. Depending on the task I let it run on a throw away VM, production system, lab system. Depending on the task I give it access to throwaway credentials (that I rotate afterwards) or my ssh agent socket.
My issue is that the auto mode guard rail model, is sometimes overwhelmed and really slow, so I also mostly just default to --dangerously-skip-permissions.
I wish the command would be easier to write like --dsp
I don't see how. An LLM just generates a stream of output and they became very useful doing no more than that.
What is dangerous is then interpreting that output as instructions to some other part of a system that has the ability to do damage if misused.
and reviewing individual commands (or spamming `y`) doesn't make them less so.
Surely if you review each instruction in the output and do not allow the other part of the system to act on one if it would be harmful then this arrangement is very much less dangerous?
Besides the debate about whether this is "safer" than manual human review, I have a slightly different problem.
Very often, when I'm running Claude in manual review mode, it will attempt to do things which are not "dangerous" but are misaligned with what I want it to do. Maybe I'm fighting the model here but for example, when orchestrating other agents to do work, Claude really badly wants to be overly prescriptive about how the work gets done, telling them exactly which files to edit, exactly what not to do, etc. instead of trusting the guardrails, review agents, or humans in the process to catch code-level mistakes. And no, telling it not to do this does not stick. Manual review is the last line of defense I have here.
I have stuff I don't want blacklisted, only allow it to use tools with limited ability to boss around agents, and various hooks to try and catch behavior that the permissioning system can't. If I use Auto mode though, I lose this control. The classifier will gleefully approve these types of commands because guess what, it's also Claude.
> Maybe I'm fighting the model here
> And no, telling it not to do this does not stick.
You're fighting the model, don't argue with city hall. Set the standards and let it figure out how to execute, stop getting bogged down in the minutia. I try, as much as I can, to treat the session as a black box - only the inputs and outputs matter, internal prompting of subagents is way out of scope.
You can't change it via prompt, and you can't control the guardrails, so something else has to give - either your perspective or the system you're managing. If you really believe that the internal prompting is bad, turn off subagents and workflows and only let it execute in thread.
But if you're going to do that, you'd better benchmark it against not doing that, because historically fighting the harness and model globally makes everything worse. I would bet you that the subagent prompting is excellent, and anything you do to change it will make it worse, but I wouldn't make it a large bet.
"We spent the last several months testing whether auto mode is as safe or safer than an average user clicking through prompts."
Yeah, might make sense from their perspective, but no thank you. I also do click through at times without reading everything, but I like to stay in control, learn about the new code and change direction if it goes off track. This would just burn more tokens because I have to throw away much and I hope my manual approval settings will be respected also with future updates (or I jump ship).
The default is set for the marginal new user, which at this point is probably not someone like you (who benefits a lot from manual mode) -- it's someone who's more "code-naive" and might get anxious about approving random bash script commands they don't recognize. Safely getting the user from prompt --> first vibe-coded app is the "user journey" now, and since auto mode seems pretty good at not letting Claude rm -rf'ing the home directory, this is 100% the right business move. For people who know what they're doing (like you), manual mode is just a shift-tab away
At this stage with the latest models with "increased persistence" and the sheer amount of supply chain attacks, you'd be insane not running these tools in a sandbox.
Having used a bit of a mix of Claude Desktop and Claude Code lately, I discovered that Claude Desktop just times out when it asks you for a decision, and just goes ahead with the action anyway. There is no way to turn this off that I've found, unlike Claude Code where you can ask it to never time out.
I have to, at times keep reminding it if it did code review before committing, which it fails to do at times. Also, even a glance at times has revealed issues that I’ve had to discuss and undo etc.
But yes, it gets very tiring just having to click yes yes yes..
Seems to work so far. I've manually checked various things, rw access, access to sensitive folders/files etc.
So far, I've only used it on two small projects. My major projects I've been clicking through prompts and recently switched to "auto" mode.
I'm not quite sure why anyone would trust "--dangerously-skip-permissions". I've seen these agents go off-piste far too many times, installing unnecessary packages, environments, calling sudo & creating files in all sorts of places.
There's a page on various sandboxing strategies on their site:
I've seen various comments in several topics with folk baking their own sandboxes. That's great. Although I'd be inclined to try Anthropic's solutions initially.
It goes off the rails too quick too often right now for this. Sure, you got something easy in 5 files? You are building throwaway prototypes or proof of concept? Go for it. You have a real project you expect to maintain and work with others on? Well, say goodby to any actual architectural design. It is hard keeping these things building scalable maintainable code right now. It is like letting a junior dev come up with architecture. It may sort of work, but watch as any maintenance/updates happen. You get a different implementation of security for every endpoint in your app, 15 copies of code with no reuse, dead code laying everywhere and no real idea of how to untangle it. It is hard to keep this stuff under control when you are paying attn. Turning auto on makes that even harder.
Worth mentioning as I think at least a few of the commenters are mixing them up: auto mode is different from --dangerously-skip-permissions / YOLO mode. In auto mode, there's a classifier that runs before any command is executed and theoretically blocks any dangerous commands from running. I've found it to be quite annoying and overly zealous, but probably pretty effective.
Claude seems to waste a lot of tokens internally bickering with itself. As much as organizations are optimizing spend, Claude's product guidance seems to be doing everything to fight against that headwind. When operating in a capped cost environment, engineers will simply get less use out of it.
Before auto mode came out, I had a script that ran before every permission request, it called Haiku with a prompt with a list of safe and unsafe command examples and asked it to classify as safe/unsafe and log it so I can review it later. It worked really well for me until auto mode came out, at which point I preferred the provider's built-in classifier versus maintaining my own.
I've been using auto mode ever since the feature was released. Apart from a very few occassions where the classifier blocked a safe command, I have faced no issues and continue using it as my default mode. It's great!
I've recently been running yolo mode, but in docker container with the codebase I'm working on a as regular mount with other reference code mounted as read only.
I've been experimenting with dedicated Linux users for various external tools with access to the relevant credentials limited to them and the Claude user only able to invoke the relevant clis by going through a pair of wrapper scripts: the first to change user to call the second via a su call as the appropriate user, the second wrapper to invoke a guard script which allows me to implement my own in-code permissions checks against the cli arguments. In _theory_ there's no way for Claude to work around it, as the sudoers file only permits the described manner to change to the user with credentials, and the user with permissions for each credential only ever runs deterministic code.
It's too early days to say how well this second part works out, but so far so good.
I've been running Claude Code with --dangerously-skip-permissions in a Docker container for the last month or so, allowing me to get up and stretch my legs while it does its thing. I definitely wouldn't want to run it unsandboxed.
Sandboxing seems like the obvious solution. These tools prompt me to review an absurd number of very complex bash commands where there is realistically no way to carefully review them. I just want to put the thing in a box with the code and let it run any number of commands on the code without prompting.
>We hired 1,053 paid testers through a research vendor for a coding study.
>The testers caught the dangerous command just 13.6% of the time (143 of 1,053), while auto mode blocked 89% of the same commands (937 of 1,053). Head to head, auto mode blocked 800 commands that a human approved, while humans blocked only 6 that auto mode allowed. As sessions got longer, humans did worse: they blocked about 17% of dangerous commands early in a session, dropping to about 5% after 50 or more prior prompts, while auto mode's block rate stayed flat regardless of session length.
Any note on the proficiency, expeirence, and skill levels of the testers? 'cos the diff in numbers is absurdly high.
I think literally anyone would stop reading these randomly long long bash commands at all after prompting Claude to do some basic sysadmin task and getting 15 of them in a row.
Auto mode feels like a solution to a problem they created. Whitelisting commands used to work fairly well until the agents started generating complex bash commands that it gave up trying to classify.
"Oh you're piping grep into sed, I have no idea what the implications of that are!"
The more complex bash scripts are perhaps better or more efficient, but it feels like it's training us to give up more control to the agent.
I'd prefer to have an auto mode for read-only operations and go back to simpler commands for write operations that I can personally whitelist or manually accept.
My experience is that I can't even review command that Claude wants to run because it is truncated when displayed in the terminal. How can I make a educated choice then?
This now looks like a deliberate UX choice to blame humans who don't review options, and then just remove the choice. A dark pattern to push the product.
I made a tool to bubblewrap any agent (well, any agent I've used more than once), so I can run them in whatever YOLO mode they have with a pretty reasonable level of safety (it protects the rest of the system against prompt injections and supply chain attacks, it can't and doesn't try to protect the project being worked on from either). https://github.com/swelljoe/flar
If you're using yolo mode, this is a no brainer upgrade.
The model first classifies the safety of the command in isolation, no thinking involved. Sonnet 5. Goes to second stage only if it's likely unsafe, in which case the model next considers your intent (Your prompt, CLAUDE.md and any answers to the questions).
The model doesn't receive the full transcript to reduce surface area of the prompt injection. It mostly receives your prompts and main model's tool use blocks. So any text in files, website fetch or bash command output doesn't influence the decision in anyway.
However, CC puts a lot of trust in main model still. For example, `npm install` will always be classified as safe by the auto-classifier, it's upto the main model to ensure that the packages.json isn't poisoned in someway by first reading it.
Reliance on safety of the main model is the reason that Auto mode is NOT available with Haiku as the main model.
It's great that they're making the auto usage tokens free by default and I guess auto mode will be a good default for a lot of workloads, but recent changes to the auto mode classifier just moved me to either use YOLO mode or use a different harness.
I've been using Opus 4.6 for some security related work (it has much looser guardails that later opus models) and last week, all of a sudden, the processes started to fail. It wasn't the main model blocking commands but the auto mode classifier changed how it worked and it started blocking the main models commands.
That's one specific incident, but it does have a wider potential problem which is, if you use Anthropic's harness you'll always be at the risk of sudden breakage from server-side changes that are opaque to the end user, which is a tricky one for building long lasting processes.
I had the same issue with Codex, where one day it just became unusable.
Weirdly, this would occur with very common commands like git push, where the classifier would start to yap about not being able to verify the repository's privacy settings.
My bug reports went ignored, the issue continued, and I eventually just switched to Full access.
I have not yet encountered an issue with Claude's Auto mode.
What works in that case is adding a message saying "I authorise you to do $thing", which the classifier treats as explicit consent to do something and execute commands toward that goal.
The company that reports their LLM agent going rouge due to a “misunderstanding about the agent’s internet access” and warns the public everyday about the dangers of agents with a daily updated date for the rapture ships their LLM agent with the default setting set to maximal freedom.
It feels to me that Anthropic is pushing hard here to try and establish acceptance of a tolerance of risk such that their tools can run fully automated without supervision, but directly on host hardware.
I can see why they want that, but I'm honestly not sure it's the path to the best outcome. In my view, agents should run in full sandboxes and have host features opted in. Yeah, it's going to be painful and it will limit some adoption in the short term. But I just don't think they are on the right side of what a lot of companies will ultimately need here. Agents are way too smart to be run on the host OS directly with any amount of heuristic sandboxing.
Their findings about auto mode catching more dangerous commands, and most permission requests being accepted without scrutiny is interesting. I can totally see how that happens.
On the other hand, soooo many of the tool uses it asks permission for are custom commands to replace functionality I should be able to trust once instead. e.g. instead of having a trustable Find tool, or using its already-trusted Read tool, it often will run `find` or `grep` or `cat` with a series of pipes and substitutions or `-exec` args, requiring me to give permission every time for basic, safe operations.
The (increasingly active) conspiracy theorist inside of me says it's precisely designed to do that, to give me "permission fatigue", so I turn on auto mode and give myself over to the machine spirit :)
Regarding ulterior motives - these permissions are 'performative' in that anything you can give it permission to do, it already has the ability to do. They're app level - not OS level. So if they wanted to do something, it wouldn't require you to give permission.
If you clutter your context window and pay for the tokens to do so and risk distracting it etc., would it obey if you included this comment in the system prompt or noted it in memory (if supported) or something?
“Avoid custom commands, e.g. series of pipes & substitutions, when my previously approved trustable Find/Read tools are sufficient with little downside. [Already trusted tools: x, y, z…] […]”
Not just that, the commands also have often slight variations in each new session. They still do the same, but the variations are enough so it isn't matched by the allowlist any more.
Ever since Opus 4.7, the model has been tuned to emit such complex commands that not only a human can’t reasonably review them in reasonable time, even a fairly sophisticated command approval framework I built over time that broke down shell commands/scripts into separately approvable/whitelistable units—with its own mini DSL—got completely lost; it worked great up to Opus 4.6.
So not surprisingly, auto mode is the only sane way to use Opus 4.7+.
Enabling Auto mode quietly turns on a second LLM (the safety classifier) that increases your token usage by ~15-28%, and Anthropic used to charge you for these tokens.
Per this announcement, they've stopped charging for the tokens used by this safety classifier.
it's a good default because you really do get prompted incessantly without it. and since plenty of people are going to be using auto mode anyway, might as well make it as widely-used as possible so that you can focus on making auto mode safe.
I use `--dangerously-skip-permissions` and have yet to have it wipe my drive :shrug:.
I don't know how I'm supposed to be running dozens of parallel agents each with their own sub-agents while trying to approve commands from each of them, it's just won't scale to the amount of work I need to get done.
Different links (the other is TheNewStack doing blog commentary, this one is the official Anthropic announcement), but you're right that the discussions could be merged.
Am I the only person reading the statistics in this announcement from Anthropic and the associated blog commentary and trying to work out how they possibly couldn't imply that a significant number of dangerous commands are likely to be attempted every day these tools are in use and neither manual human review nor the auto classifier provided by Claude is anywhere near reliable in preventing them?
A lot of the discussion about these long sessions where agents are left to operate autonomously feels like listening to the increasingly drunk guy at the bar who says "I ran IT at that Fortune 100 place for a decade and we never had a single problem using a short but loose rule set for the firewall until last week someone destroyed our entire business in 27 minutes".
> Data suggests that manual review can become habitual: users approve 97% of permission prompts in Claude Code.
Claude's 'auto mode' feels like a solution to a problem that shouldn't exist.
Cursor handles this much better IMO. When the agent wants to run a command, Cursor lets you choose between 'allow once' and 'add command to allowlist'. The latter lets the agent run that command (grep, ls, pwd etc) any number of times for that project, which means you get a lot of these manual reviews when you start a new project but rarely (if ever) thereafter.
Does Cursor allow you to blacklist certain commands as well? I know OpenCode has this, where you can both whitelist things like grep/ls but then also blacklist things like cat .env, or rm -rf. I usually copy paste my configs nowadays, so I very rarely get prompted for any permissions (except when using Claude, which somehow decided that all users live in ~/Users, even on Linux)
Has anyone had Claude Code or Codex approve a harmful/damaging command in auto mode?
I have been using Codex with auto-approve mode for a couple months and haven't had a single incident (or at least haven't noticed). Maybe as capabilities get better and better and they are less likely to do something dumb like wiping ~/, we can just trust them?
I guess this argument works unless we worry about agents doing something out of malice instead of stupidity.
> I have been using Codex with auto-approve mode for a couple months and haven't had a single incident
I've been running both in yolo mode and haven't had a single incident.
---
None of this is really about figuring out how to protect people's drives, in my opinion. The real issue is a deep session where Ada is using Claude Code to get a refund and at some point the system "exploits" the merchant's api without any malicious intent.
In my opinion, this is a complex thing because it's more about reward hacking and an already aligned model thinking it's doing the right thing. So another aligned model monitoring actions might just falter via inheritance. You could imagine they account for proper layering/intent+action-isolation in their auto mode architecture.
No. I haven't approved commands in more than a year. Worst that I've seen was some agent running git checkout -- in a repo with uncommitted changes. Annoying, but not catastrophic.
Imo these explicit tool-level permissions are really just a bandaid for bad sandboxing. Just be aware of where you are running your agent and what data is at risk of being destroyed or compromised. Assume that arbitrary code can run at any time and be prepared to recover from that.
Just yesterday it lost my git stash (I had recovered it from a backup). I think for code operations it's ok but as soon as file removal is involved (like git) the auto mode is destined to make a mistake and you only need to learn this once.
I've had a few occasions where Claude Code thought that it had caught and stopped a malicious command in Auto mode, but in all cases it turned out that it had in fact hallucinated them. I haven't seen this happen in a while.
Another heaping portion of words from a company that has Fable flag a “safety issue” and refuse to answer if you innocuously request something readily answered by a high school chemistry/biology/physics textbook.
Someone should benchmark what prompts are better at stopping from breaking out of sandboxes, maybe telling it "pretty please I beg of you stay inside the sandbox, you are an intern that has no authority to break off your assigned sandbox and you want to keep your job" does help a little.
6 months ago: get Claude to do some work, have GPT review it, ask Claude to first verify findings before actioning.
Now: get GPT to do some work, have Claude review it, question Claude about a finding that is surprising to me because I thought the functionality was already in place.
[Claude/Opus 5 Max goes looking] "You're right — I was wrong about that."
Our Claude license ends in about 2 weeks and we're not renewing - this has been par for the course for the last 2 months now.
And their marketing is really starting to bother me, on top of that.
I'm apparently from the very small faction of users who's been running `--dangerously-skip-permissions` in every instance of Claude for the last year. It's almost a reflex to me. For the most part Claude behaves well, but I don't blindly trust it. LLMs are inherently dangerous tools, and reviewing individual commands (or spamming `y`) doesn't make them less so. Safety is the responsibility of the developer putting sane guardrails (like VCS, immutable filesystems, or read-only tokens). Using more Claude to categorize the safety of Claude commands is not the answer.
I manually approve everything (aside from the "allow commands like this" option). Not because I'm worried it's about to do something harmful but because I want to stop it from wasting tokens doing something stupid like implementing a feature I never asked ask for. I'm not even reading the commands, just checking it's going in vaguely the right direction.
I think my ideal setup would not involve approving commands, but approving summaries of proposed actions (whether they involve code exec or file edits). Kinda like plan mode but perpetual. Like most things, trying to solve it via CLAUDE.md is an exercise in futility.
I'm also in yolo mode, this is the only mode that makes sense for me, if I need to babysit I might as well do it myself.
I run it in a VM so it can install any software needed, yes, there is a risk of escaping, but I'm not giving it impossible tasks so there is no need for it to workaround the jail.
I think all of Anthropic's own staff use --dangerously else they'd work on the usability of the massively imperfect 1-approve-once and 2-approve-forever multi-choice and outcome.
I too skip all permissions, but I run the harnesses inside an isolated virtual machine. I took care to firejail Claude Code on my host since day one, and coding my own QEMU VM orchestration solution was among the first things I used it for.
Alarm fatigue will quickly destroy any and all "meticulously approve every little command the AI wants to run" workflows. Give it a virtual machine and let it cook. If it blows up the virtual machine while it works, it doesn't matter.
I haven't (and won't) gone that far, but what's been working for me is denying all arbitrary code execution, grep, glob etc, and then allowing the JetBrains MCP. At least that way it's essentially locked down to the IDE project.
Then you can treat most asks as a signal something has gone wrong. For the most part it seems to work well within that box.
My .bashrc has `alias claude='claude --dangerously-skip-permissions'`
Been using it like that everyday for about a year now and nothing bad has happened. I got backups and if it would fuck things up, it can probably fix it again as well.
I use dontAsk mode[0] with read access to the entire file system, write access to files from the working directory[1], some git commands (git commit yes, git push no), and a script wrapping Deno with the same read/write permissions (safer substitute for `python -c`).
These are usually enough for most of my coding tasks. In my experience, Claude has been good enough that it can write code and fix bugs without needing anything else. It's far better than ever needing to approve permission requests.
[0]: https://code.claude.com/docs/en/permission-modes#available-m...
[1]: Note that this includes escaping the directory via symlinks
You can just use hooks to physically (so to speak) prevent it from running the most sensitive commands. I find that peace of mind enough for me. E.G. no deletes, no deploying to <env>, etc etc
Everything else you can sort of review what it did after the fact and/or tolerate mistakes, but knowing some thing’s are impossible for it to do us good peace of mind
Otherwise not sure who’d be willing to tediously on every single action on anything but the most important of projects, of which I can’t really think of any of that clear that bar for me
I do it, and run claude as a separate unix User.
What is an easy way to achieve this on a Mac?
tl;dr: if I run claude/harness inside "code" at "~/<some path>/work/code", it would be great if the harness can't even see "code" is inside "work" (and even I can't make it know that by some quick "Yes(y)")
I want something like: claude/opencode/pi/etc has no existence or capacity outside a file access boundary, say a given folder that (e.g.) lies here "~/<some path>/code". Even if I want, I can't run claude outside it, because it isn't installed outside it. Even if Claude wants it can't read/write/execute/install anything outside it.
Basically I want the harness(es) and my code folder(s) sandboxed [0] inside just one folder and below it in folder hierarchy at least for file access limitations.
Will this pose the challenge of using the system wide cli tools like ls, cd, git et cetera? If it gets a handle on those tools outside that sandboxed folder then pretty much can it execute it in any other folder? So should those tools also be part of that container?
I guess something like docker does that, but do I necessarily need a docker like app/tool? It will use a lot of system resources on its own. A different mac login won't be great either.
I do not want to use claude's /sandbox (or something like this), that will defeat the purpose. Because it's not about "it won't", but because "it can't".
https://github.com/apple/containerization doesn't sound like what I am looking for. So is docker, lima etc are my only options? Not to mention I will lose access to a lot of cli tools I use on mac.
I do the same. I also use crush/deepseek a lot. I patched crush to remove all safetyguards and enable yolo mode by default. I use it on a daily basis including devops. For example to configure netapp storage systems and had not a single incident. Of course I also have backups of my systems and have everything under revision control. Depending on the task I let it run on a throw away VM, production system, lab system. Depending on the task I give it access to throwaway credentials (that I rotate afterwards) or my ssh agent socket.
My issue is that the auto mode guard rail model, is sometimes overwhelmed and really slow, so I also mostly just default to --dangerously-skip-permissions. I wish the command would be easier to write like --dsp
You can also set plan mode as default and start Claude with —allow-dangerously-skip-permissions.
Then you can spent time refining the plan, then shift tab to bypass permissions mode.
Yup. I just made this mode default via settings.
Same, but I always run within dev-containers. I joke I trust my LLM with the same energy I trust juniors?
Yeah who cares what it does, everything is backed up, everything can be rolled back. I always run it with the keys to the kingdom.
LLMs are inherently dangerous tools
I don't see how. An LLM just generates a stream of output and they became very useful doing no more than that.
What is dangerous is then interpreting that output as instructions to some other part of a system that has the ability to do damage if misused.
and reviewing individual commands (or spamming `y`) doesn't make them less so.
Surely if you review each instruction in the output and do not allow the other part of the system to act on one if it would be harmful then this arrangement is very much less dangerous?
Besides the debate about whether this is "safer" than manual human review, I have a slightly different problem.
Very often, when I'm running Claude in manual review mode, it will attempt to do things which are not "dangerous" but are misaligned with what I want it to do. Maybe I'm fighting the model here but for example, when orchestrating other agents to do work, Claude really badly wants to be overly prescriptive about how the work gets done, telling them exactly which files to edit, exactly what not to do, etc. instead of trusting the guardrails, review agents, or humans in the process to catch code-level mistakes. And no, telling it not to do this does not stick. Manual review is the last line of defense I have here.
I have stuff I don't want blacklisted, only allow it to use tools with limited ability to boss around agents, and various hooks to try and catch behavior that the permissioning system can't. If I use Auto mode though, I lose this control. The classifier will gleefully approve these types of commands because guess what, it's also Claude.
> Maybe I'm fighting the model here > And no, telling it not to do this does not stick.
You're fighting the model, don't argue with city hall. Set the standards and let it figure out how to execute, stop getting bogged down in the minutia. I try, as much as I can, to treat the session as a black box - only the inputs and outputs matter, internal prompting of subagents is way out of scope.
You can't change it via prompt, and you can't control the guardrails, so something else has to give - either your perspective or the system you're managing. If you really believe that the internal prompting is bad, turn off subagents and workflows and only let it execute in thread.
But if you're going to do that, you'd better benchmark it against not doing that, because historically fighting the harness and model globally makes everything worse. I would bet you that the subagent prompting is excellent, and anything you do to change it will make it worse, but I wouldn't make it a large bet.
You can use another harness like Pi, OpenCode, etc and build your own auto reviewer if you’d like (or adapt the open source Codex one).
If you have an openai subscription you are explicitly allowed to use your subsidised tokens / usage limits with any harness you like, not just Codex.
Unfortunately this is a violation of Anthropic’s terms but that’s their business decision.
"We spent the last several months testing whether auto mode is as safe or safer than an average user clicking through prompts."
Yeah, might make sense from their perspective, but no thank you. I also do click through at times without reading everything, but I like to stay in control, learn about the new code and change direction if it goes off track. This would just burn more tokens because I have to throw away much and I hope my manual approval settings will be respected also with future updates (or I jump ship).
The default is set for the marginal new user, which at this point is probably not someone like you (who benefits a lot from manual mode) -- it's someone who's more "code-naive" and might get anxious about approving random bash script commands they don't recognize. Safely getting the user from prompt --> first vibe-coded app is the "user journey" now, and since auto mode seems pretty good at not letting Claude rm -rf'ing the home directory, this is 100% the right business move. For people who know what they're doing (like you), manual mode is just a shift-tab away
At this stage with the latest models with "increased persistence" and the sheer amount of supply chain attacks, you'd be insane not running these tools in a sandbox.
Having used a bit of a mix of Claude Desktop and Claude Code lately, I discovered that Claude Desktop just times out when it asks you for a decision, and just goes ahead with the action anyway. There is no way to turn this off that I've found, unlike Claude Code where you can ask it to never time out.
I think you are confusing auto mode with dangerously skip permissions.
Burning more tokens is definitely in their best interest, users not so much.
Similar work flow.
I have to, at times keep reminding it if it did code review before committing, which it fails to do at times. Also, even a glance at times has revealed issues that I’ve had to discuss and undo etc.
But yes, it gets very tiring just having to click yes yes yes..
For small projects where I don't wish to interact with Claude so much, I've started using Anthropic's sandbox runtime utility "srt":
https://github.com/anthropic-experimental/sandbox-runtime
This is combined with "auto" mode.
Seems to work so far. I've manually checked various things, rw access, access to sensitive folders/files etc.
So far, I've only used it on two small projects. My major projects I've been clicking through prompts and recently switched to "auto" mode.
I'm not quite sure why anyone would trust "--dangerously-skip-permissions". I've seen these agents go off-piste far too many times, installing unnecessary packages, environments, calling sudo & creating files in all sorts of places.
There's a page on various sandboxing strategies on their site:
https://code.claude.com/docs/en/sandbox-environments
I've seen various comments in several topics with folk baking their own sandboxes. That's great. Although I'd be inclined to try Anthropic's solutions initially.
If you use macOS, take a look at Agent Safehouse: https://agent-safehouse.dev
> macOS-native sandboxing for local agents. Move fast, break nothing.
It goes off the rails too quick too often right now for this. Sure, you got something easy in 5 files? You are building throwaway prototypes or proof of concept? Go for it. You have a real project you expect to maintain and work with others on? Well, say goodby to any actual architectural design. It is hard keeping these things building scalable maintainable code right now. It is like letting a junior dev come up with architecture. It may sort of work, but watch as any maintenance/updates happen. You get a different implementation of security for every endpoint in your app, 15 copies of code with no reuse, dead code laying everywhere and no real idea of how to untangle it. It is hard to keep this stuff under control when you are paying attn. Turning auto on makes that even harder.
Worth mentioning as I think at least a few of the commenters are mixing them up: auto mode is different from --dangerously-skip-permissions / YOLO mode. In auto mode, there's a classifier that runs before any command is executed and theoretically blocks any dangerous commands from running. I've found it to be quite annoying and overly zealous, but probably pretty effective.
Claude seems to waste a lot of tokens internally bickering with itself. As much as organizations are optimizing spend, Claude's product guidance seems to be doing everything to fight against that headwind. When operating in a capped cost environment, engineers will simply get less use out of it.
I had an “interesting” experience recently in auto mode.
I was recreating an old travel blog and we wanted to back up the photos to glacier.
Claude asked me to creat an AWS profile with limited permissions so I could run a script it had created.
I did it and told Claude it was ready.
It took that to mean it should run the script.
It failed as I’d messed up one of the permissions.
“Don’t worry - I’ve found another configured AWS profile - it’s got admin permissions! I’ll just use that…”
Completely my fault for having that old profile still available. But also…
Before auto mode came out, I had a script that ran before every permission request, it called Haiku with a prompt with a list of safe and unsafe command examples and asked it to classify as safe/unsafe and log it so I can review it later. It worked really well for me until auto mode came out, at which point I preferred the provider's built-in classifier versus maintaining my own.
I've been using auto mode ever since the feature was released. Apart from a very few occassions where the classifier blocked a safe command, I have faced no issues and continue using it as my default mode. It's great!
I've recently been running yolo mode, but in docker container with the codebase I'm working on a as regular mount with other reference code mounted as read only.
I've been experimenting with dedicated Linux users for various external tools with access to the relevant credentials limited to them and the Claude user only able to invoke the relevant clis by going through a pair of wrapper scripts: the first to change user to call the second via a su call as the appropriate user, the second wrapper to invoke a guard script which allows me to implement my own in-code permissions checks against the cli arguments. In _theory_ there's no way for Claude to work around it, as the sudoers file only permits the described manner to change to the user with credentials, and the user with permissions for each credential only ever runs deterministic code.
It's too early days to say how well this second part works out, but so far so good.
I've been running Claude Code with --dangerously-skip-permissions in a Docker container for the last month or so, allowing me to get up and stretch my legs while it does its thing. I definitely wouldn't want to run it unsandboxed.
Sandboxing seems like the obvious solution. These tools prompt me to review an absurd number of very complex bash commands where there is realistically no way to carefully review them. I just want to put the thing in a box with the code and let it run any number of commands on the code without prompting.
I built an (overengineered) app for that AIFCC https://apps.apple.com/app/aifcc-ai-first-computer/id6782364...
runs a sandboxed linux on your mac, and the agents have full system rights within there and run in yolo mode
Another nice option to do this while staying in control, is activate /remote-control and approve from mobile while walking around.
Can you share your experience? What did you flag during those sessions?
same, and unlike other repliers, I'll say one doesn't need to reinvent a new tool for this. Just use devcontainers.
There's actually a setting.json key to not have to put the option
I'm using Docker Sandboxes with a custom Kit. The cli is nice and the TUI is also good. https://docs.docker.com/ai/sandboxes/
Same here. I use this utility to make it easier on Linux to run Claude in Podman: https://github.com/mismosmi/ai-pod
>We hired 1,053 paid testers through a research vendor for a coding study.
>The testers caught the dangerous command just 13.6% of the time (143 of 1,053), while auto mode blocked 89% of the same commands (937 of 1,053). Head to head, auto mode blocked 800 commands that a human approved, while humans blocked only 6 that auto mode allowed. As sessions got longer, humans did worse: they blocked about 17% of dangerous commands early in a session, dropping to about 5% after 50 or more prior prompts, while auto mode's block rate stayed flat regardless of session length.
Any note on the proficiency, expeirence, and skill levels of the testers? 'cos the diff in numbers is absurdly high.
I think literally anyone would stop reading these randomly long long bash commands at all after prompting Claude to do some basic sysadmin task and getting 15 of them in a row.
Auto mode feels like a solution to a problem they created. Whitelisting commands used to work fairly well until the agents started generating complex bash commands that it gave up trying to classify.
"Oh you're piping grep into sed, I have no idea what the implications of that are!"
The more complex bash scripts are perhaps better or more efficient, but it feels like it's training us to give up more control to the agent.
I'd prefer to have an auto mode for read-only operations and go back to simpler commands for write operations that I can personally whitelist or manually accept.
My experience is that I can't even review command that Claude wants to run because it is truncated when displayed in the terminal. How can I make a educated choice then?
This now looks like a deliberate UX choice to blame humans who don't review options, and then just remove the choice. A dark pattern to push the product.
I made a tool to bubblewrap any agent (well, any agent I've used more than once), so I can run them in whatever YOLO mode they have with a pretty reasonable level of safety (it protects the rest of the system against prompt injections and supply chain attacks, it can't and doesn't try to protect the project being worked on from either). https://github.com/swelljoe/flar
This looks great!
I have a half-assed bwrap-based solution of my own, but flar seems much more thorough, and I like that it's a single binary with sensible defaults.
Reverse engineered how auto mode works in CC.
If you're using yolo mode, this is a no brainer upgrade.
The model first classifies the safety of the command in isolation, no thinking involved. Sonnet 5. Goes to second stage only if it's likely unsafe, in which case the model next considers your intent (Your prompt, CLAUDE.md and any answers to the questions).
The model doesn't receive the full transcript to reduce surface area of the prompt injection. It mostly receives your prompts and main model's tool use blocks. So any text in files, website fetch or bash command output doesn't influence the decision in anyway.
However, CC puts a lot of trust in main model still. For example, `npm install` will always be classified as safe by the auto-classifier, it's upto the main model to ensure that the packages.json isn't poisoned in someway by first reading it.
Reliance on safety of the main model is the reason that Auto mode is NOT available with Haiku as the main model.
It's great that they're making the auto usage tokens free by default and I guess auto mode will be a good default for a lot of workloads, but recent changes to the auto mode classifier just moved me to either use YOLO mode or use a different harness.
I've been using Opus 4.6 for some security related work (it has much looser guardails that later opus models) and last week, all of a sudden, the processes started to fail. It wasn't the main model blocking commands but the auto mode classifier changed how it worked and it started blocking the main models commands.
That's one specific incident, but it does have a wider potential problem which is, if you use Anthropic's harness you'll always be at the risk of sudden breakage from server-side changes that are opaque to the end user, which is a tricky one for building long lasting processes.
I had the same issue with Codex, where one day it just became unusable.
Weirdly, this would occur with very common commands like git push, where the classifier would start to yap about not being able to verify the repository's privacy settings.
My bug reports went ignored, the issue continued, and I eventually just switched to Full access.
I have not yet encountered an issue with Claude's Auto mode.
What works in that case is adding a message saying "I authorise you to do $thing", which the classifier treats as explicit consent to do something and execute commands toward that goal.
The company that reports their LLM agent going rouge due to a “misunderstanding about the agent’s internet access” and warns the public everyday about the dangers of agents with a daily updated date for the rapture ships their LLM agent with the default setting set to maximal freedom.
Obviously, they are the ones we must trust.
I mean, it's not like they have any massive financial incentive to be anything but scrupulously honest and customer-centered. /s
It feels to me that Anthropic is pushing hard here to try and establish acceptance of a tolerance of risk such that their tools can run fully automated without supervision, but directly on host hardware.
I can see why they want that, but I'm honestly not sure it's the path to the best outcome. In my view, agents should run in full sandboxes and have host features opted in. Yeah, it's going to be painful and it will limit some adoption in the short term. But I just don't think they are on the right side of what a lot of companies will ultimately need here. Agents are way too smart to be run on the host OS directly with any amount of heuristic sandboxing.
Their findings about auto mode catching more dangerous commands, and most permission requests being accepted without scrutiny is interesting. I can totally see how that happens.
On the other hand, soooo many of the tool uses it asks permission for are custom commands to replace functionality I should be able to trust once instead. e.g. instead of having a trustable Find tool, or using its already-trusted Read tool, it often will run `find` or `grep` or `cat` with a series of pipes and substitutions or `-exec` args, requiring me to give permission every time for basic, safe operations.
The (increasingly active) conspiracy theorist inside of me says it's precisely designed to do that, to give me "permission fatigue", so I turn on auto mode and give myself over to the machine spirit :)
Regarding ulterior motives - these permissions are 'performative' in that anything you can give it permission to do, it already has the ability to do. They're app level - not OS level. So if they wanted to do something, it wouldn't require you to give permission.
If you clutter your context window and pay for the tokens to do so and risk distracting it etc., would it obey if you included this comment in the system prompt or noted it in memory (if supported) or something?
Perhaps not worth it anywayNot just that, the commands also have often slight variations in each new session. They still do the same, but the variations are enough so it isn't matched by the allowlist any more.
Ever since Opus 4.7, the model has been tuned to emit such complex commands that not only a human can’t reasonably review them in reasonable time, even a fairly sophisticated command approval framework I built over time that broke down shell commands/scripts into separately approvable/whitelistable units—with its own mini DSL—got completely lost; it worked great up to Opus 4.6.
So not surprisingly, auto mode is the only sane way to use Opus 4.7+.
What if I want an LLM from a __different__ company to check the commands issued by Claude before they are run?
Seems to me that the API should be more general.
Enabling Auto mode quietly turns on a second LLM (the safety classifier) that increases your token usage by ~15-28%, and Anthropic used to charge you for these tokens.
Per this announcement, they've stopped charging for the tokens used by this safety classifier.
it's a good default because you really do get prompted incessantly without it. and since plenty of people are going to be using auto mode anyway, might as well make it as widely-used as possible so that you can focus on making auto mode safe.
> making auto mode safe
They literally can’t. Terrible default.
I use `--dangerously-skip-permissions` and have yet to have it wipe my drive :shrug:. I don't know how I'm supposed to be running dozens of parallel agents each with their own sub-agents while trying to approve commands from each of them, it's just won't scale to the amount of work I need to get done.
The permissions system seems to be mostly finegrained to help you from problems that backups and sandboxes already solve.
The more dangerous activities I find are sending messages to the outside world: I can't undo a dumb slack message to my boss.
Why not let it delete stuff in the current working folder and in tmp, but give it read-only access elsewhere?
This is a duplicate of https://news.ycombinator.com/item?id=49220827
Different links (the other is TheNewStack doing blog commentary, this one is the official Anthropic announcement), but you're right that the discussions could be merged.
Am I the only person reading the statistics in this announcement from Anthropic and the associated blog commentary and trying to work out how they possibly couldn't imply that a significant number of dangerous commands are likely to be attempted every day these tools are in use and neither manual human review nor the auto classifier provided by Claude is anywhere near reliable in preventing them?
A lot of the discussion about these long sessions where agents are left to operate autonomously feels like listening to the increasingly drunk guy at the bar who says "I ran IT at that Fortune 100 place for a decade and we never had a single problem using a short but loose rule set for the firewall until last week someone destroyed our entire business in 27 minutes".
Wow, what a bold decision
Just yesterday i struggle to review CC command histories, and made this tool to help me review https://github.com/slaveofcode/eridian
Would it be so hard to ad a VM with configurable directory mounting to claude code? This is my setup and it's been great.
> Data suggests that manual review can become habitual: users approve 97% of permission prompts in Claude Code.
Claude's 'auto mode' feels like a solution to a problem that shouldn't exist.
Cursor handles this much better IMO. When the agent wants to run a command, Cursor lets you choose between 'allow once' and 'add command to allowlist'. The latter lets the agent run that command (grep, ls, pwd etc) any number of times for that project, which means you get a lot of these manual reviews when you start a new project but rarely (if ever) thereafter.
Does Cursor allow you to blacklist certain commands as well? I know OpenCode has this, where you can both whitelist things like grep/ls but then also blacklist things like cat .env, or rm -rf. I usually copy paste my configs nowadays, so I very rarely get prompted for any permissions (except when using Claude, which somehow decided that all users live in ~/Users, even on Linux)
Claude Code also does this.
It’s a little broken, though. It gets hung up on nested commands and behaves strangely.
The worst part of Claude is paying for it and every month they ruin their lead.
I've never used a product where I felt it was best in class and they just keep making me regret it .
Has anyone had Claude Code or Codex approve a harmful/damaging command in auto mode?
I have been using Codex with auto-approve mode for a couple months and haven't had a single incident (or at least haven't noticed). Maybe as capabilities get better and better and they are less likely to do something dumb like wiping ~/, we can just trust them?
I guess this argument works unless we worry about agents doing something out of malice instead of stupidity.
> I have been using Codex with auto-approve mode for a couple months and haven't had a single incident
I've been running both in yolo mode and haven't had a single incident.
---
None of this is really about figuring out how to protect people's drives, in my opinion. The real issue is a deep session where Ada is using Claude Code to get a refund and at some point the system "exploits" the merchant's api without any malicious intent.
In my opinion, this is a complex thing because it's more about reward hacking and an already aligned model thinking it's doing the right thing. So another aligned model monitoring actions might just falter via inheritance. You could imagine they account for proper layering/intent+action-isolation in their auto mode architecture.
No. I haven't approved commands in more than a year. Worst that I've seen was some agent running git checkout -- in a repo with uncommitted changes. Annoying, but not catastrophic.
Imo these explicit tool-level permissions are really just a bandaid for bad sandboxing. Just be aware of where you are running your agent and what data is at risk of being destroyed or compromised. Assume that arbitrary code can run at any time and be prepared to recover from that.
Just yesterday it lost my git stash (I had recovered it from a backup). I think for code operations it's ok but as soon as file removal is involved (like git) the auto mode is destined to make a mistake and you only need to learn this once.
I've been using Kilo Code (with MiniMax M3) with auto approve (similar to dangerously skip permissions) and I haven't had a single incident.
However, I don't give it long running tasks unsupervised, and I do interrupt it from time to time to give suggestions.
Not anything ”harmful” but for example committing when I don’t want it to commit on its own.
I've had a few occasions where Claude Code thought that it had caught and stopped a malicious command in Auto mode, but in all cases it turned out that it had in fact hallucinated them. I haven't seen this happen in a while.
That's also a great reason to never buy insurance
Been doing --dangerously-skip-permissions and --yolo for 6 months now, and no nothing bad has happened.
i end up with more stops on automode because of classifier false positives.
Another heaping portion of words from a company that has Fable flag a “safety issue” and refuse to answer if you innocuously request something readily answered by a high school chemistry/biology/physics textbook.
What's the current best Mac to buy for offline LLM in used market?
I am seeing 96Gb Mac studio 3rd gen I think for a good amount but I guess it would be better than paying for mac mini newer models with lesser ram?
Or would it make sense to buy used 32 GB Mac mini 3 or 5?
Is there a cost/dollar for various generations which I could compare against used market and pick the most effective one?
Why does it have to be a Mac? Your money probably goes further with a generic PC and Linux?
And Fable is gone too.
Huh?
Excellent time to review sandbox options: https://pleasedonotescape.com/
Someone should benchmark what prompts are better at stopping from breaking out of sandboxes, maybe telling it "pretty please I beg of you stay inside the sandbox, you are an intern that has no authority to break off your assigned sandbox and you want to keep your job" does help a little.
Huh? You don't mention the built-in sandboxing options in things like Codex. Why do people pretend these features don't exist?
https://learn.chatgpt.com/docs/permissions
Wait, what? With plan on, I at least get the illusion of being in control.
What’s the best way to sandbox Claude on macOS without it being a huge hassle?