Claude Code update lets agent skip rm permission checks

Anthropic has given Claude Code users a way to remove the last permission check left in its most permissive mode. The latest build of its coding agent, v2.1.311, supports an environment variable called CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS. When it is set, the agent can run the file-deleting rm command without asking for approval, The Register reported on October 27.theregister.com

The change matters because developers often treated the existing –dangerously-skip-permissions flag as having a hidden floor. That floor was a block on deleting critical paths such as the user's home directory. The new variable takes it away.

An announcement that some users doubted

Daisy Hollman, a member of technical staff at Anthropic, announced the change in a social media post, according to The Register. "Fun fact: –dangerously-skip-permissions doesn't actually approve EVERYTHING – we still block some obvious things like rm -rf ~," she wrote. "But today's release will let you disable this if you really want." Some readers doubted the post, partly because the change does not appear in the v2.1.311 changelog. Hollman answered: "Not a joke! I hope this helps, and I hope the variable name is memorable."theregister.com

The official changelog dates v2.1.311 to October 26. Anthropic's Japanese-language permission-mode documentation now describes the variable. It says that setting the variable and launching in bypassPermissions mode lets rm and rmdir commands that target critical paths run without a prompt.code.claude.com+1

What the old safeguard covered

The flag turns on bypassPermissions mode, which first appeared in Claude Code v1.0.18 on June 9, 2025, The Register noted. The mode skips most approvals, but Anthropic's English documentation lists a few actions it never approves automatically. One of them is rm and rmdir removals of critical paths. Those include the filesystem root, top-level directories, the home directory and the working directory. In a terminal session, these commands bring up a two-minute countdown, and the command is denied if no one answers. The documentation also warns that this check "can miss some commands, so it doesn't replace an operating-system control such as sandboxing."code.claude.com+1

Sandboxing and admin controls

Anthropic already tells users to run bypassPermissions only "in isolated environments like containers, VMs, or dev containers without internet access." The company says the mode "offers no protection against prompt injection or unintended actions," according to its documentation. Administrators can block the mode entirely through managed settings, and Claude Code will not start in it as root on Linux or macOS. The Register said managed settings may still limit the new variable. It also noted that there are "numerous accounts of AI agents issuing commands like rm -rf ~ that wipe hard drives."code.claude.com+1