Claude Code can now let rm -rf ~ run without asking. What the new variable does

What Anthropic released

On October 26, 2026, Daisy Hollman, a member of Anthropic’s technical staff who works on Claude Code, posted on X: “Fun fact: --dangerously-skip-permissions doesn’t actually approve EVERYTHING—we still block some obvious things like rm -rf ~. But today’s release will let you disable this if you really want, by setting a new env var CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS=1.”

The release was Claude Code 2.1.311, which reached npm that afternoon. Its changelog doesn’t mention the variable, and not everyone believed it was real. “Not a joke!” Hollman replied, The Register reported. “I hope this helps, and I hope the variable name is memorable.”

Claude Code’s permission modes docs now describe it. Start Claude Code with the variable in its environment “to run Bash rm and rmdir commands that target critical paths with no prompt in bypassPermissions mode.” It needs version 2.1.311 or later. On macOS, Linux and WSL:

export CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS=1
claude --permission-mode bypassPermissions

The docs’ warning is plain: “With this variable set, you lose a safety prompt for destructive deletes: a command such as rm -rf ~ can run without asking you. Set it only in an isolated environment whose contents you can afford to lose.”

What bypass mode still stopped

Bypass permissions mode, which --dangerously-skip-permissions turns on, “disables permission prompts and safety checks so tool calls execute immediately.” It never quite approved everything. Even in it, Claude Code still asks or refuses for your explicit ask rules, tools that need your input, some messages between sessions, and rm or rmdir on what the docs call critical paths:

• the filesystem root and the folders directly under it, such as /usr, /etc or /data
• your home folder
• Windows drive roots and the folders directly under them, such as C:\ and C:\Windows
• your working directory and its parents
• a glob under an added working directory, such as rm -rf <dir>/*

No allow rule can approve one of those removals. What happens instead depends on the mode, and the variable changes only one row:

Mode	A critical-path rm	With the variable set
Manual, Accept edits, Plan	Asks you	No change
Auto	Asks in the terminal, for two minutes; refused elsewhere	No change
Don’t ask	Refused	No change
Bypass permissions	Asks in the terminal, for two minutes; refused in the desktop app and VS Code’s chat panel	Runs without asking, except in the desktop app and VS Code’s chat panel

The two minutes are a countdown: if nobody answers, Claude Code refuses the command and tells Claude what to do instead, so an unattended session carries on.

Anthropic had spent months tightening this check. By the changelog, version 2.1.208 on July 13 made rm -rf ~ prompt in commands that also contain $(…) or backticks, 2.1.281 on September 23 added the countdown, 2.1.304 on October 19 added mounted drives such as /Volumes, and 2.1.309 on October 22 made the desktop app and VS Code refuse these removals at once in bypass mode. Earlier variables each switched off one narrow case. 2.1.311 switches off the check for bypass mode in one go.

Where it works, and where it doesn’t

The variable acts only in a session started in bypass permissions mode from an environment where it’s set: the claude command, in a terminal or with -p, or an Agent SDK app. According to the docs, it has no effect:

• In a settings file. Claude Code reads it “from the launch environment only” and ignores it in a settings file’s env block.
• In the desktop app or VS Code’s chat panel. There, bypass mode refuses critical-path removals unless a PermissionRequest hook allows them. An IDE’s built-in terminal counts as a terminal.
• In plan mode, even when bypass permissions are available.
• In sessions Claude Code starts for you, such as background sessions, agent team teammates in split panes and sessions a Remote Control server creates, or in a claude started from inside another session.
• When something else answers permission prompts, such as a PermissionRequest hook, or a --permission-prompt-tool or Agent SDK canUseTool callback in a run without --permission-prompts none.
• When a deny or ask rule covers Bash, Edit or Read, or permissions.blockReadsOutsideWorkingDirectories is on.
• When managed settings can’t be read, including, on Windows and in WSL, when the registry can’t be queried.

It covers only rm and rmdir run through the Bash and Monitor tools, and with it set, “commands Claude Code can’t fully parse” run without a prompt too. PowerShell’s Remove-Item keeps its own checks, which refuse to remove system paths and your home folder in every mode.

To see whether it took, read the line Claude Code prints at startup. It says the variable “is set, so dangerous rm commands can run without a prompt,” or that it “has no effect in this session.”

Should you set it?

For most people, no.

1. On your own computer, leave it off. Claude Code starts new terminal and VS Code sessions in auto mode by default, where a second model reviews actions (our memo on auto mode covers it). With bypass mode and this variable, even an rm -rf ~ that Claude Code recognizes runs without anyone being asked. Anthropic’s advice for bypass mode alone is to use it “only in isolated environments like containers, VMs, or dev containers without internet access.”
2. In a throwaway container or virtual machine, it’s what the variable is for. By the docs’ definition, a folder directly under the root, such as /app or /workspace in a container, is a critical path, as is the working directory, so an unattended run that tries to remove one is refused. Set the variable in that environment, not in your shell profile.
3. Keep a real boundary anyway. The docs say the check “can miss some commands, so it doesn’t replace an operating-system control such as sandboxing.” A command it misses already ran without a prompt in bypass mode, variable or not.
4. If you need only certain removals, approve them with a PermissionRequest hook, which the docs say can answer these prompts, and leave the check on for the rest.
5. Check you haven’t set it by accident. If the startup line appears and you didn’t set the variable, the docs say to find where it’s set, “such as your shell profile, and remove it.”
6. For an organization, the variable does nothing without bypass mode, and admins can turn that mode off by setting permissions.disableBypassPermissionsMode to "disable" in managed settings.

How Codex and Copilot compare

Codex and GitHub Copilot CLI each have a mode that skips approvals too, and their docs describe no separate check on deletions:

Agent	Mode that skips approvals	What its docs say still applies
Claude Code	Bypass permissions (--dangerously-skip-permissions)	Ask rules, some prompts, and the critical-path rm check unless the variable is set
Codex	--dangerously-bypass-approvals-and-sandbox, or --yolo	“No sandbox; no approvals (not recommended)”
GitHub Copilot CLI	Allow all (--allow-all, or --yolo)	“Existing deny rules and enterprise restrictions”

OpenAI’s approvals docs suggest giving Codex its isolation at the container level before running it this way. GitHub’s docs say Allow all “removes your oversight of individual actions.” By their docs, then, the variable makes Claude Code’s bypass mode work much as the other two’s already do.

What Anthropic hasn’t said

• Why now. Hollman’s post says only “if you really want.” Anthropic hasn’t said who asked for it or what it’s meant for.
• Why it isn’t in the changelog. Neither the 2.1.311 nor the 2.1.312 entry mentions it; only the docs do.
• How often the check fires, or how many deletions it has stopped.
• Whether it will come to the desktop app or VS Code’s chat panel. For now, the docs say it has no effect there.

Claude Code in Enjoy

Enjoy runs Claude Code on the Claude plan you already have, and it answers Claude Code’s permission prompts itself. Claude Code’s docs say the variable has no effect when another program does that. So in Enjoy, even in Bypass permissions, a removal Claude Code flags as dangerous comes to the conversation as a card with the exact command, to allow once or decline, unless a hook of your own answers it first. Enjoy remembers the permission mode you last used with each agent in each project, and never picks a broader one for you. Enjoy is a monthly subscription, with the first seven days free (pricing).