Topic starter
14/09/2026 10:09 am
TL;DR: Claude Code’s --dangerously-skip-permissions flag removes the session-wide permission gate for file edits, shell commands, MCP tools, and network access, and Obsidian Security argues the real risk is not the flag itself but running it in an environment with over-scoped credentials and unmapped reach. The access review assumption collapses when an agent can act, delegate, and exfiltrate within a single session before any human review can occur.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “--dangerously-skip-permissions: What It Actually Does and How to Contain It”.
Key questions
Q: What breaks when Claude Code runs with --dangerously-skip-permissions?
A: The human approval gate and its audit trail disappear for the full session, so the agent can execute file changes, shell commands, tool calls, and network actions without review.
Q: Why does over-scoped agent access create more risk in MCP environments?
A: Over-scoped access turns an agent into a fast-moving operator with too many permissions and too little friction.
Q: What are the signs that an agentic workflow is exceeding its intended control boundary?
A: Warning signs include hidden retries, widening search windows, unlogged tool calls, persistent state that outlives the task, and fallback logic that keeps expanding scope.
Practitioner guidance
- Contain agent sessions in isolated runtimes Run skip-permissions sessions in a container or VM that contains only the repository, with no production credentials, no SSH keys and minimal network reach.
- Scope connected MCP credentials separately Give each MCP server its own narrowly scoped credential so the agent cannot inherit broad write or exfiltration rights from one shared token.
- Inventory agent reach continuously Track which agents connect to which MCP servers, who approved those connections and what systems each credential can actually touch at runtime.
Bottom line: Claude Code’s skip-permissions mode is risky because it removes the last human checkpoint from a session that may already have broad file, shell, tool and network reach.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
Access review assumes access persists long enough to be reviewed, and that assumption breaks in agentic sessions. The article’s core failure mode is not simply faster execution. It is that the agent can request, use and complete work before a human review cycle ever begins. That means traditional recertification logic is too slow for session-scoped machine behaviour, and practitioners must stop treating runtime access as if it were stable human access.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams contain agentic sessions before they touch production data?
A: Start by isolating the runtime, then deny irreversible actions and scope the credentials behind every connected tool. The goal is not to eliminate automation. It is to make the session’s real reach small enough that a skipped prompt does not become a production incident. If the environment cannot be tightly bounded, the flag should not be used there.
👉 Read our full editorial: Claude Code skip-permissions shows the real risk in agentic access