Claude Code skip-permissions shows the real risk in agentic access

At a glance

What this is: This is an analysis of Claude Code’s --dangerously-skip-permissions flag and the article’s core finding that the danger comes from unscoped environment reach, not the flag alone.

Why it matters: It matters because agentic access controls must account for runtime reach, connected tools and credential scope, not just whether a human sees a permission prompt.

Context

Claude Code’s skip-permissions mode removes the session-wide approval gate that normally stands between an agentic action and execution. In plain terms, the flag turns off the prompt before file edits, shell commands, MCP tool calls and network activity, so the agent can operate at full speed with whatever access the session already has.

For identity teams, the governance problem is not the prompt itself. It is the assumption that access can be safely reviewed after the fact, when the agent may already have used over-scoped credentials, touched multiple connected systems and moved data in a single run. That is why agentic access has to be governed as a runtime identity problem, not a developer convenience feature.

Key questions

Q: What breaks when Claude Code runs with --dangerously-skip-permissions?

A: The human approval gate and its audit trail disappear for the full session, so the agent can execute file changes, shell commands, tool calls, and network actions without review. That is safe only when the environment is tightly isolated and the reachable credentials are already constrained to the task.

Q: Why does over-scoped agent access create more risk in MCP environments?

A: Over-scoped access turns an agent into a fast-moving operator with too many permissions and too little friction. In MCP environments that increases lateral movement, misuse of tools, and data exfiltration risk because one compromised or misdirected chain can reach far beyond its intended task. Narrow scopes, short TTLs, and explicit approval for destructive actions reduce that exposure.

Q: What are the signs that an agentic workflow is exceeding its intended control boundary?

A: Warning signs include hidden retries, widening search windows, unlogged tool calls, persistent state that outlives the task, and fallback logic that keeps expanding scope. Those signals show the workflow is making governance decisions at runtime rather than staying inside a clearly bounded execution model.

Q: How should teams contain agentic sessions before they touch production data?

A: Start by isolating the runtime, then deny irreversible actions and scope the credentials behind every connected tool. The goal is not to eliminate automation. It is to make the session’s real reach small enough that a skipped prompt does not become a production incident. If the environment cannot be tightly bounded, the flag should not be used there.

Technical breakdown

What --dangerously-skip-permissions actually removes

Claude Code’s permission gate is an execution checkpoint, not a capability limiter. The flag removes that checkpoint for the entire session, which means the agent can write and delete files, run shell commands, invoke MCP tools and reach the network without asking first. The important distinction is that the agent already had those rights through the environment; the flag removes the human review moment and the audit trail created by each prompt. That shifts the control boundary from pre-action approval to the surrounding environment, especially the credentials and connections already present in the session.

Practical implication: Treat approval prompts as a weak control if the session environment is not separately contained and scoped.

Why connected MCP servers create the largest blast radius

The agent’s effective authority is the union of every connected MCP server and every credential behind them. A coding agent may look local, but once it can call services that hold production credentials, message channels or cloud APIs, its practical reach extends far beyond the repository. That creates a classic identity aggregation problem: individually acceptable permissions combine into an unsafe composite path. The article’s key point is that the risk is often not one privileged system, but the ability to chain several ordinary ones into read, modify and exfiltrate outcomes inside a single session.

Practical implication: Inventory each MCP connection and evaluate the combined reach of the agent, not each server in isolation.

How irreversible actions and prompt injection become execution risks

Two failure modes dominate once prompts are removed. First, destructive commands can be executed against the wrong target because the agent acts on stale or mis-scoped context. Second, untrusted content can shape instructions inside the agent’s context and flow straight into execution when no human approval gate remains. In both cases, the issue is not that the model becomes more capable, but that the last control that separated suggestion from action disappears. That is a governance failure in the execution path, not a model-quality problem.

Practical implication: Block irreversible commands before execution and assume untrusted input can become an action path.

Threat narrative

Attacker objective: Use a trusted agentic session to reach, alter or exfiltrate data through legitimate but over-broad access paths before a human can contain the action.

1. Entry occurs when a developer runs Claude Code with --dangerously-skip-permissions in an environment that already contains authenticated access and connected tools.
2. Escalation happens as the agent uses its full session authority across files, shell commands, MCP servers and network access without human approval gates.
3. Impact follows when over-scoped credentials or connected systems let the session modify data, move information outward or touch production systems before review can intervene.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Access review assumes access persists long enough to be reviewed, and that assumption breaks in agentic sessions. The article’s core failure mode is not simply faster execution. It is that the agent can request, use and complete work before a human review cycle ever begins. That means traditional recertification logic is too slow for session-scoped machine behaviour, and practitioners must stop treating runtime access as if it were stable human access.

Blast-radius governance is now the real control plane for agentic access. The meaningful question is not whether an agent can be allowed to act, but how much of the environment it can reach if it does. Obsidian Security’s analysis shows that MCP connections, cloud credentials and network reach combine into one effective permission set. Practitioners should interpret this as a shift from prompt control to exposure mapping.

Unmapped third-party access is the named concept this article sharpens: agentic reach debt. When connected tools and credentials accumulate without a current inventory, the environment inherits hidden paths that no approval prompt can see. That debt compounds because the agent’s actual authority is the union of all reachable systems, not the intended workflow. The implication is straightforward: identity governance for agents must start with reach discovery, not policy hope.

Containment must move closer to execution than most IAM programmes are built to support. The article shows why container isolation, deny lists and pre-execution checks matter more than broad policy statements when actions are irreversible. This is not about adding more review steps. It is about recognising that agentic work can cross the line from intention to impact within one session, which makes execution-time controls the decisive layer.

Agentic access cannot be governed as a variant of human admin access. Human-centric controls assume a person, a context and a review interval that persists long enough to be audited. An agent with over-scoped MCP reach collapses those assumptions by chaining actions, tools and network paths without delay. Practitioners need to reframe agent sessions as ephemeral non-human identities with runtime authority, not as temporary users.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Authorisation Guide

What this signals

Agentic access becomes a governance problem the moment session authority exceeds the task boundary. The operational question is no longer whether an AI agent can help complete work, but whether the environment can prevent that help from turning into overreach. When runtime reach is not mapped, traditional access review timing is too slow to matter.

Access review cadences were designed for identities that persist long enough to be observed, certified and removed. Agentic sessions collapse that timing model, which is why runtime containment and credential scoping now matter more than post-hoc approval. A AI agent authorisation guide becomes relevant whenever teams need to convert intent into enforceable boundaries.

Reach visibility is the control that closes the gap between policy and execution. In practice, teams should know which agents can reach production data, which MCP servers they touch and which credentials are actually live. That is especially important because 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.

For practitioners

• Contain agent sessions in isolated runtimes Run skip-permissions sessions in a container or VM that contains only the repository, with no production credentials, no SSH keys and minimal network reach.
• Scope connected MCP credentials separately Give each MCP server its own narrowly scoped credential so the agent cannot inherit broad write or exfiltration rights from one shared token.
• Inventory agent reach continuously Track which agents connect to which MCP servers, who approved those connections and what systems each credential can actually touch at runtime.
• Block irreversible actions before execution Use persistent deny rules or pre-execution hooks to stop destructive commands, protected-branch changes, credential access and outbound data movement.
• Treat untrusted input as potential instructions Review prompt-injection paths in issue text, web content, tool responses and file content, then block execution when instructions arrive through data channels.

Key takeaways

• Claude Code’s skip-permissions mode is risky because it removes the last human checkpoint from a session that may already have broad file, shell, tool and network reach.
• The critical exposure is not the flag itself but the combination of over-scoped credentials, connected MCP servers and unbounded runtime authority.
• Containment has to happen at execution time through isolation, deny rules, scoped credentials and reach inventory, or the agent can outrun review.

Key terms

• Agentic Access: Agentic access is delegated system access granted to an AI agent or autonomous workflow so it can perform defined tasks across tools and data sources. It differs from human access because the actor can execute continuously, combine actions quickly, and amplify mistakes at scale.
• Execution-path control: Execution-path control is the practice of enforcing policy at the moment an agent takes action, not after the fact. It treats each tool call, data access, or chained step as an authorisation event, which is essential when agent behaviour unfolds dynamically across systems.
• MCP Reach: MCP reach is the effective access an agent gains through connected Model Context Protocol servers. It includes whatever data, actions and side effects those servers can trigger, which means a single session can inherit far more authority than the local workspace suggests.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.