Claude Code's New "Even More Dangerously Skip Permissions" Variable: What It Does and Doesn't

The Register reported on October 27, 2026 that Claude Code build v2.1.311 added an environment variable named CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS. The Register's story says that setting it to 1 in a shell lets the agent run rm and rmdir without approval. Before, even the --dangerously-skip-permissions flag still stopped to ask before deleting. The headline's "jump out of a plane without a parachute" is a metaphor for removing that last prompt.

This post separates what The Register reports from what Anthropic's own documentation says, explains how Claude Code's permission modes fit together, and lists what to do if you run agents on a machine you care about. We could not independently verify the variable's exact behavior, so treat the details as reported.

TL;DR: what we know

Agents that act on your behalf need rules. Agentbeam stops the dangerous actions →

How Claude Code permission modes fit together

Our explainer on Claude Code permission modes covers the ladder in detail. In short, as Anthropic's documentation describes:

• Default: the agent asks before risky actions.
• Auto mode: a separate classifier reviews each action. It blocks actions that escalate beyond your request, target unrecognized infrastructure or look driven by hostile content. It became the default for many sessions with v2.1.283 and later, as we noted in auto mode becoming the default.
• bypassPermissions: disables permission prompts and most safety checks, so tool calls run immediately. Anthropic's docs say to use it only in isolated environments such as containers or VMs without internet access.

The new variable, as reported, sits above bypass mode: it removes the deletion prompt that bypass mode had kept.

What the docs say stays blocked

Anthropic's permission-modes page lists protections that apply even in bypass mode, including recognized critical-path rm and rmdir removals: the filesystem root, top-level directories like /usr, your home directory, your working directory and its parents, and globs under the working directory. It also flags rm -rf "$DIR"/* where an empty variable would delete from root.

That is the behavior the new variable reportedly loosens. The docs also say the check can miss some commands, so it never replaced operating-system controls such as sandboxing. And managed settings can switch the whole mode off with permissions.disableBypassPermissionsMode.

The Register notes Hollman's point that the existing flag did not approve "everything": some commands, like rm -rf ~, remain blocked. Whether that remains true with the new variable set is the key question to check on a throwaway machine, not your laptop.

Why would Anthropic add this?

We can only infer. People who run agents in disposable containers hit the deletion prompt constantly, since build cleanups, rm -rf node_modules and temp-directory resets are routine. A prompt in a headless CI job stalls the run. An opt-in escape hatch with an absurd name is a way to say: you asked for this, you own the consequences.

The naming is a design choice as well as a joke. Long, scary environment variable names are speed bumps that stop casual use and make code review catch it. Recent history shows why the caution is warranted: we have covered cases where agents ran commands users did not expect, such as Claude Code finding a cryptominer, and an Anthropic red-team study in which auto-mode monitors failed against 55% of attacks.

A short history of skipping permissions in Claude Code

The Register dates the pattern. The bypassPermissions mode first appeared in Claude Code v1.0.18 on June 9, 2025, reachable through a flag already named --dangerously-skip-permissions. Anthropic made auto mode the default in August 2026, which put a classifier between the agent and most actions for everyday users. The new variable is the next rung up, aimed at the narrow group that runs agents unattended in disposable environments.

Each rung follows the same logic. Approval prompts are the main way a human stays in the loop, but they also make agents slow, and the more capable the agent becomes the more users want to remove them. Vendors respond by adding alternative controls (classifiers, sandboxes, deny rules) and by moving the remaining prompt-free behavior behind increasingly alarming names.

What a safe setup looks like

If you do want unattended runs, build the safety outside the agent:

• Disposable container: start from a clean image, copy in only the repository, and destroy it after the run.
• No credentials: do not pass cloud keys, SSH agents or tokens that the task does not need. A deleted file can be restored; a leaked key cannot be un-leaked.
• Network limits: if the task does not need the internet, cut it. That removes most prompt-injection exfiltration paths.
• Resource and time caps: a runaway loop should hit a limit and stop.
• Review the diff: treat the result like a pull request from a stranger. Look at deletions first.

Notice that none of this depends on Claude Code's own prompts. That is the point: the agent's setting is a convenience, and the container is the control.

Real risks of unattended deletion

• Wrong path: an agent that builds a path from a variable can delete far more than intended if the variable is empty.
• Prompt injection: a README, web page or issue that the agent reads can instruct it to delete files. With no approval step, the agent is the only gate.
• Mounted volumes: in a container, a mounted host directory is just as deletable as the container's own files.
• Git is not backup: untracked files, local .env files and ignored build outputs are gone for good.

How to protect yourself

1. Do not set the variable on your daily machine. Use a container or VM that holds only a copy of the repository.
2. Mount read-only where you can, and never mount your home directory or cloud credentials.
3. Keep deny rules. Anthropic's docs say deny rules still block in bypass mode; list paths you never want touched.
4. Commit before runs and keep backups outside the working tree.
5. Prefer auto mode for work on a real machine. It reviews each action instead of waving all through.
6. Administrators: set permissions.disableBypassPermissionsMode to disable in managed settings if your policy forbids bypass mode.
7. Add an independent guard. AgentBeam is the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions, as a layer that does not depend on the agent's own settings.

For the wider picture of agents taking consequential actions on systems they do not own, see our running tracker at /felony-bench and the legal liability analysis of AI agents.

Questions developers are likely to ask

Is this the same as the old flag? No. The flag, per Anthropic's docs, disables permission prompts and most safety checks but keeps a prompt for recognized critical-path removals. The variable is reported to remove that remaining prompt for rm and rmdir.

Will it work in auto mode? The docs describe auto mode as classifier-driven with its own block list, including recursive forced deletes whose target variable was never assigned in the conversation. Nothing we read says the new variable changes auto mode, so do not assume it does.

Can a project file turn it on for me? The docs say bypassPermissions set in project or local settings files does not take effect, a guard against a cloned repository silently enabling dangerous behavior. An environment variable is different because it comes from the shell that launches Claude Code, so check what your CI, shell profile and dev-container configuration export.

What should a team lead do today? Search your dev-container and CI configuration for the name, add it to a code-review checklist as a red flag, and decide whether managed settings should disable bypass entirely for engineers working on laptops.

What if the agent deletes something anyway? Stop the session, check version control and filesystem snapshots, and restore from backup. If it happened because of injected instructions, report it to the tool's vendor and rotate any secrets the agent could read.

What is still unconfirmed

• The exact behavior with the variable set, including which rm forms still prompt.
• Whether Anthropic will document it in the changelog and permission-modes page.
• Whether managed settings can disable the variable specifically; the docs we read only mention the broader bypass switch.

We will update this post when Anthropic documents the variable.

Related reading

• Claude Code permission modes explained
• Claude Code auto mode becomes the default
• Claude Code v2.1.301 and v2.1.302: auto mode model and more
• Auto-mode monitors fail 55% of attacks
• Claude Code found an XMRig cryptominer
• Felony Bench: AI agent legal liability
• Official: Claude Code permission modes and changelog

Details are accurate as of October 28, 2026 and rely on The Register's reporting for the variable itself; verify against Anthropic's docs.