TL;DR: Claude AI’s analysis shows that claude --dangerously-skip-permissions removes Claude Code’s per-action approval layer, letting file writes, shell commands, and MCP tool calls run unattended while leaving evidence mainly on the endpoint, according to Repello AI research. The real control problem is not model misuse but local blast radius, so detection, managed settings, and session forensics become the decisive governance layer.
At a glance
What this is: This is a runbook for responding when Claude Code is run with --dangerously-skip-permissions, a flag that disables per-action approval and can let unattended tool use alter files, invoke shells, and extend access through MCP.
Why it matters: It matters to IAM and security teams because the control failure sits at the boundary between developer privilege, endpoint telemetry, and NHI governance, where runtime action cannot be reconstructed from cloud logs alone.
Context
Claude Code’s permission model is built around per-action approval, so the governance gap appears when a developer or script disables that checkpoint and moves execution into unattended mode. In that state, the relevant security question is not whether the model is capable of harm, but whether the organisation can still govern the actions it is allowed to take.
This is a workstation and release-process problem as much as an AI problem. The session transcript, process arguments, local config, and git history become the evidence chain, which is why endpoint visibility and NHI governance intersect so directly here.
Key questions
Q: What breaks when a coding agent runs without per-action approval?
A: The control that breaks is not code safety but runtime authorisation. Every tool call inherits the local user’s privilege, so file edits, shell commands, and plugin or MCP actions can proceed without the pause that normally creates human review. That makes the blast radius depend on endpoint permissions, not just prompt quality or model behaviour.
Q: Why do local session transcripts matter more than cloud audit logs for AI coding agents?
A: Cloud logs usually show request timing and usage metadata, but not the commands, paths, or files the agent touched. Local transcripts capture the actual tool chain, so they are the artefact that lets investigators reconstruct impact, commit scope, and any off-project writes. Without them, response teams only see the billing trail, not the action trail.
Q: What are the signs that a developer workstation agent is operating outside its intended boundary?
A: Look for the flag in process telemetry, shell aliases, setup scripts, or CI steps, especially when it appears without a sandbox guard such as IS_SANDBOX. Also watch for writes to home-directory credential stores, unexpected MCP registrations, or git activity that does not match the developer’s normal workflow. Those signals indicate delegated execution has escaped its intended containment.
Q: Should organisations rely on auto mode instead of blocking risky agent flags?
A: No. Auto mode reduces the chance of obvious destructive actions, but it does not remove the underlying need for policy enforcement, endpoint detection, and transcript collection. Organisations should use it as a safer default while still disabling bypass modes and monitoring for unmanaged installs. Otherwise, the risky path remains available whenever a developer chooses it.
Technical breakdown
How the skip-permissions flag changes execution control
Claude Code normally asks before each tool call, so the user can allow, deny, or scope the action. --dangerously-skip-permissions removes that gate and lets the model execute file edits, shell commands, and tool calls without a human approval step. That matters because the security boundary moves from per-action authorisation to whatever privilege the local user already has. If the developer account can write to a path, the agent can too. In governance terms, this is not a new identity, but a privileged delegation mechanism with very weak runtime friction. See the AI Agent Authorisation Guide. See the AI Agent Authorisation Guide.
Practical implication: Treat the flag as a privilege escalation path on the endpoint and block it at policy level, not just in code review.
Why local transcripts matter more than provider audit logs
The most useful evidence is the Claude Code JSONL session transcript, not the provider-side request log. Anthropic’s logs can show token counts and request timing, but they do not reconstruct the tool chain, file paths, or shell commands the agent executed. The JSONL files record each tool use with timestamps, which lets investigators align execution with git history, filesystem changes, and suspicious network calls. That makes the endpoint the primary source of truth. If your detection strategy only watches SaaS audit logs, it will miss the operational behaviour that matters. See the AI Coding Agents Security Guide.
Practical implication: Preserve endpoint transcripts and process telemetry as first-class forensic artefacts, not optional troubleshooting data.
Why MCP extends the blast radius of unattended sessions
MCP is not just a plugin mechanism. It is an execution extension layer that can add new tools and new environment access at runtime. If a session can register or use an unexpected MCP server, the agent may gain a persistent capability that survives beyond the immediate command that introduced it. That turns a one-off unattended session into a longer-lived control concern, because the tool surface itself may have changed. In a machine-identity context, MCP servers can behave like delegated service components with their own trust boundaries. See the AI Agent Tool and Plugin Security Guide.
Practical implication: Inventory MCP server definitions and validate their binaries, arguments, and environment exposure before treating a session as contained.
Threat narrative
Attacker objective: The objective is to use trusted local execution to make unauthorised changes or extend access without a human seeing each action in real time.
- Entry occurs when a developer or script invokes Claude Code with --dangerously-skip-permissions, removing the per-action approval prompt and allowing unattended execution.
- Credential and privilege exposure follow because the agent executes with the developer’s local authority, reaching writable files, shell commands, and any MCP tools already trusted by the workstation.
- Impact appears when the session modifies code, changes local configuration, registers new tool access, or writes outside the intended project boundary, creating persistent operational and forensic risk.
Breaches seen in the wild
- AI LLM hijack breach: attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Unattended agent execution is a governance problem before it is an AI problem. The flag turns a chat-based tool into an endpoint actor that can write files, run commands, and invoke MCP tools without per-action consent. That shifts the security question from model behaviour to delegated authority and local blast radius. Organisations that still treat this as a novelty risk are behind the actual control failure, which is runtime authorisation on the workstation.
Session transcripts are the real audit trail for workstation agents. Provider logs are useful for usage accounting, but they do not explain what the agent touched, changed, or attempted. The local JSONL record is therefore the evidence source that matters for incident response, compliance, and post-commit review. For practitioners, the control gap is not log volume, but log location and retention.
Claude Code demonstrates the NHI problem in miniature. The agent is not a human user, but it acts through human credentials and local trust, which is exactly why NHI governance has to include workstation agents, CLI agents, and their runtime permissions. That makes NHI governance relevant here: unmanaged delegation is what creates the blind spot, not the model itself.
MCP turns a local session into a broader trust extension surface. Once an unattended session can add or use new MCP servers, the organisation is no longer only governing commands. It is governing a changing tool inventory with its own access paths and environment exposure. Practitioners should treat this as an access lifecycle issue, not just a developer-experience setting.
Auto mode reduces friction, but it does not remove the need for detection. The safer default narrows the chance of destructive actions, yet the skip-permissions flag still exists and still bypasses the classifier when explicitly invoked. That means policy, endpoint telemetry, and managed settings all remain necessary. The operational lesson is simple: the safer workflow is not the same as a governed workflow.
From our research library:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- Read next: AI Coding Agents Security Guide
What this signals
Unattended workstation agents create a governance blind spot. Once a developer can run a CLI agent without per-action approval, the organisation has to govern action provenance at execution time, not after the fact. That pushes security teams toward endpoint telemetry, transcript retention, and stricter control over local delegation paths.
Session-level evidence becomes the control plane. The practical unit of risk is no longer just the repo commit, but the sequence of tool calls that produced it. According to the State of Secrets Sprawl 2026, Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025. That is why detection and audit need to move closer to the workstation.
MCP expands the trust boundary beyond the editor. A session that can register or call new tools can turn a one-off command into a broader privilege and data exposure problem. According to the State of Secrets Sprawl 2026, 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption. Practitioners should treat tool registration as part of identity governance, not as an application plug-in detail.
For practitioners
- Block the skip-permissions flag at the organisation level Use managed settings to disable bypass permissions mode so the CLI refuses the flag at startup, then test unmanaged installs to confirm the block survives local workarounds.
- Search endpoints for unattended agent use Look for the literal flag string in process command lines, shell history, CI job logs, and setup scripts, because that is the fastest way to identify where agent execution was made unattended.
- Preserve the local session corpus Collect ~/.claude/projects/ session JSONL files, because they contain the tool-use transcript needed to reconstruct file writes, shell commands, and MCP activity after the fact.
- Review git history against session timestamps Compare git reflog, git log, and the JSONL timestamps to separate committed changes from ephemeral writes and to identify any agent action that escaped review.
- Validate MCP server registrations Inspect mcp_servers.json and per-project .mcp.json files for unknown binaries, unexpected environment access, and any tool registration that expands the agent’s effective trust boundary.
Key takeaways
- The central risk is unattended local execution, not model autonomy, because the flag removes the approval gate that normally constrains each tool call.
- The evidence chain lives on the endpoint in JSONL transcripts, process arguments, and git history, which makes cloud logs insufficient on their own.
- The most effective controls are managed settings, endpoint detection, transcript preservation, and validation of any MCP server that widens the tool surface.
Related NHI Mgmt Group resources: AI Coding Agents Security Guide · AI Agent Authorisation Guide · Privileged Access Management Guide · AI Agent Tool and Plugin Security Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The flag bypasses the approval checkpoint that governs trusted agent execution. |
| NHI-05 — Overprivileged NHI | The agent inherits local privilege and can act beyond what the workflow intended. | |
| NHI-07 — Long-Lived Secrets | The article highlights local credential exposure and persistent workstation risk during unattended sessions. | |
| Recommendation — Treat bypassed approval flows as insecure authentication and disable them in managed settings. Constrain agent execution to the least privilege needed for each task and environment. Reduce long-lived exposure by preventing agent writes into credential-bearing local paths. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Unattended tool use is a direct example of privilege abuse in an agentic workflow. |
| Recommendation — Map unattended CLI agent behaviour to identity and privilege abuse controls before allowing production use. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The runbook is built around detecting access to local credentials and spread across files and tools. |
| Recommendation — Hunt for credential access and lateral movement indicators in workstation agent telemetry and transcripts. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The issue is uncontrolled entitlement to act on the endpoint without a human gate. |
| Recommendation — Apply PR.AA-05 to ensure agent permissions are explicit, bounded, and enforceable at the workstation. | ||
Key terms
- Unattended Execution: Unattended execution is runtime behaviour that proceeds without a human watching, approving, or interrupting the action chain. For scheduled agents, that means the control model must shift from interactive oversight to pre-run scoping, because the useful human checkpoint no longer exists during execution.
- Session Transcript: A local record of an agent session that captures tool calls, file edits, and command execution in chronological order. For workstation agents, it is often the most complete forensic source because provider-side logs usually lack the actual commands and paths involved.
- MCP Server Registration: The process of adding a Model Context Protocol server that extends what an agent can call at runtime. In security terms, it changes the agent’s effective tool surface and can persist beyond a single session if it is written into configuration.
- Managed Settings: A persistent configuration layer that defines what an AI coding tool may do, what it must ask about, and what it cannot touch. For identity teams, this becomes the policy boundary that governs command execution, tool use, and exposure to sensitive paths.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is a practical fit for teams that need to govern delegated access, machine identities, and agent permissions across modern environments.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org