# Running Claude Code, Codex and Gemini CLI safely

> I want my coding agent to stop asking me before every command. How do I do that without it wrecking my machine or leaking my keys?

What Claude Code, OpenAI's Codex and Gemini CLI do out of the box, what their "skip the prompts" modes switch off, and why the safe answer is a separate machine rather than a setting.

Guide page: https://botperch.com/guides/coding-agents-safely/  
Checked: 2026-10-29

**Short answer:** Let it run without prompts only on a machine you can afford to lose, not your laptop. All three agents have a mode that approves everything, and Anthropic's advice for its version is "Only use this mode in isolated environments like containers, VMs, or dev containers without internet access", because it "offers no protection against prompt injection". Of the three, only Codex starts inside a sandbox with the network off; Claude Code's sandbox is off until you turn it on.

## What each agent does out of the box

**Claude Code.** From version 2.1.283, interactive sessions start in an "auto" permission mode [(5)](#src-5); the older manual mode starts read-only and asks before edits and commands [(6)](#src-6). Either way, the project folder is only a permission prompt, not a wall: "a Bash command you approve can still write anywhere your user account can" [(7)](#src-7). Claude Code also has a sandbox for shell commands, but "The sandbox is off by default" [(4)](#src-4), it covers shell commands only, not its file tools, MCP servers or hooks [(8)](#src-8), and by default sandboxed commands can still read "credential files such as ~/.ssh and ~/.aws/credentials" [(9)](#src-9). Its network goes through a local proxy whose allowed sites "start empty" [(10)](#src-10).
**Codex.** OpenAI's agent combines a sandbox with an approval policy. "By default, the agent runs with network access turned off" [(3)](#src-3). Its three sandbox levels are read-only [(11)](#src-11), workspace-write, which can edit and run routine commands inside the project [(12)](#src-12), and danger-full-access, which "runs without sandbox restrictions" [(13)](#src-13). With the on-request policy it works inside the sandbox and asks before going beyond it [(14)](#src-14).
**Gemini CLI.** Google's agent can isolate "shell commands or file modifications" from your computer [(15)](#src-15), using containers [(16)](#src-16) or, on Linux, gVisor, which it calls its "Strongest isolation available" [(17)](#src-17). Its default macOS profile "confines writes to the project directory while allowing broad file reads and network access" [(18)](#src-18).

## Skipping the prompts ("YOLO mode")

Each agent has a switch that approves everything. In Claude Code it is --dangerously-skip-permissions, the same as the bypassPermissions mode [(19)](#src-19); Anthropic's docs say this mode "offers no protection against prompt injection or unintended actions" [(2)](#src-2), and it refuses to start as root or under sudo [(20)](#src-20). Codex's is --dangerously-bypass-approvals-and-sandbox, "alias: --yolo" [(21)](#src-21), which means "No sandbox; no approvals" [(22)](#src-22). In Gemini CLI the old --yolo flag is deprecated in favour of --approval-mode=yolo [(23)](#src-23), which will "Automatically approve all tool calls" [(24)](#src-24).
These modes exist for good reasons: long unattended tasks, CI jobs, agents working overnight. The question is not whether to use them but where. Anthropic's answer is an isolated container or virtual machine without internet access [(1)](#src-1).

## A sandbox shrinks the damage; it does not remove it

Anthropic's own docs are blunt: "Sandbox isolation reduces the impact of a breach, but it does not eliminate risk" [(25)](#src-25). Any setup that lets the agent reach the internet "can still leak data the agent can read", and any setup that mounts your project writable "can still modify that code" [(26)](#src-26). Isolation also "does not change what is sent to the model" [(27)](#src-27).
Two traps catch people. A development container still shares your project folder: "Claude can still modify any file in the bind-mounted workspace, which appears directly on your host" [(28)](#src-28). And OpenAI warns that with full access inside a dev container, "a malicious project can exfiltrate anything available inside the devcontainer, including Codex credentials" [(29)](#src-29). Codex's network filter also covers only commands it runs, not "web search, app or connector tool calls, MCP server connections, browser or Computer Use activity" [(30)](#src-30).

## A setup that holds up

Our reading of the sources above, not a vendor's instruction: run the agent on a cloud machine of its own, as in [giving a coding agent its own machine](https://botperch.com/use-cases/coding-agent/), so the worst case is a machine you delete. Anthropic itself recommends virtual machines "to run scripts and make tool calls, especially when interacting with external web services" [(31)](#src-31).
Then shrink what it can reach. Keep only the keys that task needs on the machine, ideally behind a provider that keeps them out of the agent's sight ([Secrets the agent cannot read](https://botperch.com/capabilities/hidden-secrets/)), with a hard spend limit on the model key (see [giving an agent your API keys](https://botperch.com/guides/api-keys/)). Allow only the sites it needs ([Allow only some sites](https://botperch.com/capabilities/egress-allowlist/)), but keep the list tight: "Allowing broad domains such as github.com can create paths for data exfiltration" [(32)](#src-32). And take a snapshot before a long unattended run ([Snapshots of files](https://botperch.com/capabilities/snapshot-files/)), so a bad night costs a restore, not a rebuild.

## Sources

- [Claude Code docs: permission modes](https://code.claude.com/docs/en/permission-modes) (docs-confirmed, checked 2026-10-29): "Only use this mode in isolated environments like containers, VMs, or dev containers without internet access, where Claude Code cannot damage your host system."
- [Claude Code docs: permission modes](https://code.claude.com/docs/en/permission-modes) (docs-confirmed, checked 2026-10-29): "`bypassPermissions` offers no protection against prompt injection or unintended actions."
- [OpenAI Codex docs: approvals and security](https://learn.chatgpt.com/docs/agent-approvals-security) (docs-confirmed, checked 2026-10-29): "By default, the agent runs with network access turned off."
- [Claude Code docs: sandboxing](https://code.claude.com/docs/en/sandboxing) (docs-confirmed, checked 2026-10-29): "The sandbox is off by default."
- [Claude Code docs: permission modes](https://code.claude.com/docs/en/permission-modes) (docs-confirmed, checked 2026-10-29): "With Claude Code v2.1.283 or later, auto mode is the built-in starting permission mode for interactive terminal and VS Code sessions."
- [Claude Code docs: security](https://code.claude.com/docs/en/security) (docs-confirmed, checked 2026-10-29): "Manual mode: Claude Code starts with read-only permissions."
- [Claude Code docs: security](https://code.claude.com/docs/en/security) (docs-confirmed, checked 2026-10-29): "The boundary is a permission prompt, so a Bash command you approve can still write anywhere your user account can"
- [Claude Code docs: sandboxing](https://code.claude.com/docs/en/sandboxing) (docs-confirmed, checked 2026-10-29): "The sandbox covers shell commands only. Claude's file tools, MCP servers, and hooks run outside it."
- [Claude Code docs: sandboxing](https://code.claude.com/docs/en/sandboxing) (docs-confirmed, checked 2026-10-29): "Most of the machine, including credential files such as `~/.ssh` and `~/.aws/credentials`"
- [Claude Code docs: sandboxing](https://code.claude.com/docs/en/sandboxing) (docs-confirmed, checked 2026-10-29): "Connections go through a proxy on your machine that checks each host against your allowed domains, which start empty."
- [OpenAI Codex docs: sandboxing](https://learn.chatgpt.com/docs/sandboxing) (docs-confirmed, checked 2026-10-29): "`read-only`: The agent can inspect files, but it can't edit files or run commands without approval."
- [OpenAI Codex docs: sandboxing](https://learn.chatgpt.com/docs/sandboxing) (docs-confirmed, checked 2026-10-29): "`workspace-write`: The agent can read files, edit within the workspace, and run routine local commands inside that boundary."
- [OpenAI Codex docs: sandboxing](https://learn.chatgpt.com/docs/sandboxing) (docs-confirmed, checked 2026-10-29): "`danger-full-access`: The agent runs without sandbox restrictions."
- [OpenAI Codex docs: sandboxing](https://learn.chatgpt.com/docs/sandboxing) (docs-confirmed, checked 2026-10-29): "`on-request`: The agent works inside the sandbox by default and asks when it needs to go beyond that boundary."
- [Gemini CLI docs: sandboxing](https://raw.githubusercontent.com/google-gemini/gemini-cli/main/docs/cli/sandbox.md) (docs-confirmed, checked 2026-10-29): "Sandboxing isolates potentially dangerous operations (such as shell commands or file modifications) from your host system"
- [Gemini CLI docs: sandboxing](https://raw.githubusercontent.com/google-gemini/gemini-cli/main/docs/cli/sandbox.md) (docs-confirmed, checked 2026-10-29): "Cross-platform sandboxing with complete process isolation using container technology."
- [Gemini CLI docs: sandboxing](https://raw.githubusercontent.com/google-gemini/gemini-cli/main/docs/cli/sandbox.md) (docs-confirmed, checked 2026-10-29): "Strongest isolation available: runs containers inside a user-space kernel via gVisor."
- [Gemini CLI docs: sandboxing](https://raw.githubusercontent.com/google-gemini/gemini-cli/main/docs/cli/sandbox.md) (docs-confirmed, checked 2026-10-29): "confines writes to the project directory while allowing broad file reads and network access."
- [Claude Code docs: permission modes](https://code.claude.com/docs/en/permission-modes) (docs-confirmed, checked 2026-10-29): "The `--dangerously-skip-permissions` flag is equivalent."
- [Claude Code docs: permission modes](https://code.claude.com/docs/en/permission-modes) (docs-confirmed, checked 2026-10-29): "Claude Code refuses to start in `bypassPermissions` mode when running as root or under `sudo`"
- [OpenAI Codex docs: approvals and security](https://learn.chatgpt.com/docs/agent-approvals-security) (docs-confirmed, checked 2026-10-29): "`--dangerously-bypass-approvals-and-sandbox` (alias: `--yolo`)"
- [OpenAI Codex docs: approvals and security](https://learn.chatgpt.com/docs/agent-approvals-security) (docs-confirmed, checked 2026-10-29): "No sandbox; no approvals"
- [Gemini CLI docs: CLI reference](https://raw.githubusercontent.com/google-gemini/gemini-cli/main/docs/cli/cli-reference.md) (docs-confirmed, checked 2026-10-29): "Deprecated. Auto-approve all actions. Use `--approval-mode=yolo` instead."
- [Gemini CLI docs: configuration](https://raw.githubusercontent.com/google-gemini/gemini-cli/main/docs/reference/configuration.md) (docs-confirmed, checked 2026-10-29): "`yolo`: Automatically approve all tool calls (equivalent to `--yolo`)"
- [Claude Code docs: sandbox environments](https://code.claude.com/docs/en/sandbox-environments) (docs-confirmed, checked 2026-10-29): "Sandbox isolation reduces the impact of a breach, but it does not eliminate risk."
- [Claude Code docs: sandbox environments](https://code.claude.com/docs/en/sandbox-environments) (docs-confirmed, checked 2026-10-29): "Any approach that allows network egress can still leak data the agent can read, and any approach that mounts your project directory writable can still modify that code."
- [Claude Code docs: sandbox environments](https://code.claude.com/docs/en/sandbox-environments) (docs-confirmed, checked 2026-10-29): "Isolation also does not change what is sent to the model."
- [Claude Code docs: development containers](https://code.claude.com/docs/en/devcontainer) (docs-confirmed, checked 2026-10-29): "Claude can still modify any file in the bind-mounted workspace, which appears directly on your host, and reach anything the container's network policy allows."
- [OpenAI Codex docs: approvals and security](https://learn.chatgpt.com/docs/agent-approvals-security) (docs-confirmed, checked 2026-10-29): "a malicious project can exfiltrate anything available inside the devcontainer, including Codex credentials"
- [OpenAI Codex docs: approvals and security](https://learn.chatgpt.com/docs/agent-approvals-security) (docs-confirmed, checked 2026-10-29): "The network proxy filters scripts, programs, and child processes that run inside the local command sandbox. It does not filter web search, app or connector tool calls, MCP server connections, browser or Computer Use activity, Codex cloud tasks, or the client's model and authentication requests."
- [Claude Code docs: security](https://code.claude.com/docs/en/security) (docs-confirmed, checked 2026-10-29): "Use virtual machines (VMs) to run scripts and make tool calls, especially when interacting with external web services"
- [Claude Code docs: sandboxing](https://code.claude.com/docs/en/sandboxing) (docs-confirmed, checked 2026-10-29): "Allowing broad domains such as `github.com` can create paths for data exfiltration."