Notifications
Clear all
Topic starter
14/09/2026 10:09 am
TL;DR: Claude Code’s --dangerously-skip-permissions flag removes the session-wide permission gate for file edits, shell commands, MCP tools, and network access, and Obsidian Security argues the real risk is not the flag itself but running it in an environment with over-scoped credentials and unmapped reach. The access review assumption collapses when an agent can act, delegate, and exfiltrate within a single session before any human review can occur.
NHIMG editorial — based on content published by Obsidian Security: AI Security --dangerously-skip-permissions: What It Actually Does and How to Contain It
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing access credentials.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
Questions worth separating out
Q: What breaks when Claude Code runs with --dangerously-skip-permissions?
A: The human approval gate and its audit trail disappear for the full session, so the agent can execute file changes, shell commands, tool calls, and network actions without review.
Q: Why do agentic coding tools increase identity risk even when the prompt is useful?
A: Because the real security boundary is not the prompt, it is the agent’s effective reach across files, tools, credentials, and network paths.
Q: How should teams reduce the blast radius of AI coding agents in production-adjacent systems?
A: Teams should restrict agent credentials to the smallest possible scope, separate staging from production authority, and keep backups outside the same writable boundary as live data.
Practitioner guidance
- Isolate every skip-permissions session Run agentic coding sessions in a container or VM that holds only the repository, with no production credentials, no pre-authenticated cloud CLI, and restricted network access.
- Pre-deny irreversible operations Block destructive database commands, force pushes, credential file access, and outbound data movement with persistent policy rules before the agent starts.
- Add a pre-execution policy hook Inspect the actual command and its target environment before execution so a destructive action aimed at production from a dev session is refused in time.
What's in the full article
Obsidian Security's full blog post covers the operational detail this post intentionally leaves for the source:
- The specific five-layer containment model for agentic coding sessions, including which layers are cheapest to deploy first
- Runtime enforcement examples for Claude and Microsoft Copilot, which are useful once you are moving from policy to implementation
- How to build an inventory of connected MCP servers and map their effective access across real SaaS applications
- The practical distinction between declared configuration and actual runtime reach when agent credentials drift over time
👉 Read Obsidian Security's analysis of Claude Code skip-permissions and containment →
Claude Code skip-permissions: are your agent controls keeping up?
Explore further
14/09/2026 10:10 am
Session-wide approval removal is now an identity event, not a workflow preference. The moment an AI coding agent can run shell commands, touch files, call tools, and reach the network without a human gate, its identity behaviour changes materially. That moves the control problem out of prompt design and into runtime authority management. The practitioner conclusion is that approval suppression must be governed as access expansion, not as a developer convenience.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing access credentials, according to the 2026 Infrastructure Identity Survey: state of AI adoption.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How should organisations handle AI agent permissions in authorization systems?
A: Treat AI agents as task-bound actors, not as full substitutes for the user whose session launched them. Every agent action should be checked against the minimum resource scope required for that task, because inherited human permissions are usually broader than the workflow needs.
👉 Read our full editorial: Claude Code skip-permissions shows the real risk in agentic access
