contenox

YOLO mode in Claude Code, Codex, Copilot and Cursor

Updated

SAFETY AND CONTROL YOLO mode

YOLO mode means running a coding agent with its approval prompts turned off: it edits files, runs commands and fetches URLs without asking you first. The name started as a real setting in Cursor in December 2024. Today it’s slang for each tool’s skip-all switch: --dangerously-skip-permissions in Claude Code, --yolo in Codex, Copilot CLI and the Cursor CLI, Run Everything in the Cursor editor, and --auto in OpenCode.

They don’t all turn off the same thing. Codex’s switch also removes the sandbox; Claude Code’s keeps your deny rules.

The switch in each tool

ToolYOLO switchWhat it turns offWhat still applies
Claude Codeclaude --dangerously-skip-permissionsEvery prompt, and allow rules stop matteringDeny rules, explicit ask rules, prompts for rm on critical paths, the sandbox if enabled
Codexcodex --yolo (--dangerously-bypass-approvals-and-sandbox)Every approval and the sandbox: no file or network limitsNothing from Codex itself
Copilot CLIcopilot --yolo (--allow-all), or /yolo in a sessionPrompts for tools, paths and URLsDeny rules and enterprise policy
VS Code (Copilot)/yolo in chat (this session), or chat.tools.global.autoApprove (everywhere)Tool approvalsOrganization policy
Cursor editorRun mode Run EverythingPrompts, the sandbox and the reviewing modelProtections you leave on (file deletion, outside files, browser)
Cursor CLIagent --yolo (--force)Command approvals, workspace trust, MCP approvalsDeny rules in cli.json
OpenCodeopencode --auto, opencode run --autoEvery ask ruleRules set to deny
DeepSeek HarnessThe danger-full-access presetApprovals and the write sandboxNothing from the harness

Why does everyone end up using it?

Because the alternative is usually worse. In the default modes, a real task means dozens of prompts: every test run, every build, every git add. After the twentieth, nobody reads them. A prompt you approve without reading protects nothing; it only slows you down.

So people switch to YOLO, and that includes people who know better. The team behind this site builds a permission system, and still runs Claude Code in Bypass permissions mode for daily work, because the modes in between didn’t fit the work.

The fix isn’t more willpower. It’s a middle mode that doesn’t wear you out, so the off switch stops being tempting.

The new middle: a model approves for you

In 2026, all four big tools answered the same way: a second model looks at each action and approves the routine ones.

ToolModeWho decides
Claude Codeauto (the default since v2.1.283)A classifier model checks each action; after 3 blocks in a row it goes back to asking
Codex--approve-for-me, or approvals_reviewer = "auto_review"An automatic reviewer, inside the workspace-write sandbox
CopilotAssisted (/permissions assisted in the CLI)A model approves requests it judges safe
CursorAuto-review (the default)Allowlisted commands run, others go to the sandbox, the rest to a model

This cuts the prompts a lot, and it’s a real improvement over YOLO. Two limits are worth knowing. The reviewer is a model, so it can be wrong in both directions, and Cursor’s docs say plainly it’s “not a security boundary”. And you can’t read in advance what it will allow: the decision is made per action, and tomorrow’s model may judge differently.

Can I use YOLO mode safely?

Yes, inside a box where a mistake can’t reach anything that matters. Claude Code’s docs say to use bypass mode only in an isolated container or VM, ideally without internet. Codex’s docs say its YOLO flag is for “an externally hardened environment”.

That means:

  • A container or VM with only the project mounted. No home folder, no SSH keys, no cloud credentials, no browser profile.
  • A disposable copy. A fresh clone or git worktree, so the worst case is deleting a folder.
  • Limited network, if the task allows it. A run that can’t reach the internet can’t leak anything to it.
  • A cloud agent, which works on a copy of the repo on someone else’s machine by design.

On your own machine, with your real keys and your real git remotes, YOLO mode is a bet that nothing goes wrong this time.

The sandbox gotcha: Codex’s --yolo removes its sandbox entirely. If you want fewer prompts in Codex, keep the sandbox and change only the approvals: codex --approve-for-me, or -a never together with --sandbox workspace-write. Then Codex never asks, but it still can’t write outside the project or reach the network.

What to use instead

Ordered from closest to YOLO to safest:

  1. YOLO plus a sandbox. Claude Code with {"sandbox": {"enabled": true}} runs sandboxed commands without asking, and the sandbox limits writes to the project. It works on macOS, Linux and WSL2; on native Windows, commands run without a sandbox. Codex with -a never --sandbox workspace-write does the same.
  2. A reviewer mode: auto, Auto-review, Assisted, --approve-for-me. Few prompts, the judgment of a model.
  3. Rules for your routine commands: allow npm test *, npm run build, git add * once, and keep prompts for the rest. See why your agent keeps asking for the exact syntax per tool.
  4. Edits without asking, commands with asking: Claude Code’s acceptEdits mode, Copilot’s chat.tools.edits.autoApprove.

Contenox

Contenox takes the third route and makes it the default, so there’s no reason to reach for an off switch. Out of the box, it reads freely and runs builds, tests, linters and read-only git commands without asking. Edits ask; rm, mv, sudo and output redirects always ask; disk-wiping commands are blocked; SSH keys, cloud credentials and browser profiles are off-limits; and the agent can’t edit its own rules or the .git folder.

For your own machine, there’s a set that allows everything not named and still asks before risky commands and history changes: the speed of YOLO without the dangerous part. Every rule is plain text you can read before you start, not a model’s judgment call. See built-in tools and permissions.

Related

Esc to close