Anthropic adds environment variable that lets Claude Code skip final file-deletion prompt

Anthropic has added an environment variable to Claude Code that removes the final safety prompt blocking destructive file operations like deleting an entire filesystem root. The variable is named, with zero subtlety, CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS.

Set to 1, it lets the AI coding agent run rm and rmdir commands against critical paths, including / and the home directory, without pausing to ask a human if that’s really what they want.

What the variable actually does

Claude Code already had a permission mode called bypassPermissions, which removes the normal approval prompts that pop up before the agent takes actions on your system.

The new variable goes one step further. Even inside bypassPermissions mode, there was still a single, final confirmation prompt specifically protecting critical deletion commands. That was the last speed bump before Claude could wipe a filesystem root or a home directory in a fully automated pipeline.

The new environment variable, introduced in Claude Code version 2.1.311, removes that last prompt entirely. The agent can now proceed through the entire sequence, including potentially catastrophic file deletions, without a single human in the loop.

Anthropic engineer Daisy Hollman announced the change publicly. The company has been clear that bypass modes are intended only for use inside isolated containers or virtual machines, where a runaway deletion command damages a throwaway environment rather than someone’s actual work.

The permission system has five tiers in total: Manual (the default, which prompts for each action), acceptEdits, plan, auto (which uses a classifier to review actions), and bypassPermissions, where nothing is blocked. The new variable sits at the very bottom of that stack, below even bypassPermissions.

The tension between safety and automation

The variable’s name reads less like a developer tool and more like a liability waiver written in snake_case. That naming choice is deliberate, and it does real work: any developer who types it out manually is making an active, conscious decision to proceed, which is harder to do accidentally than flipping a one-word flag.

Users approve approximately 93% of manual permission prompts in Claude Code. That figure tells a story: the safety prompts are, in the overwhelming majority of cases, just friction. Developers building fully automated pipelines, continuous integration workflows, or agentic coding systems need the agent to act without stopping to ask questions every few seconds.

The problem is that the 7% of cases where someone says no almost certainly includes some genuinely dangerous moments. Collapsing that gap entirely, even optionally, means developers are now responsible for making sure the environment is safe before they set the flag, not after.

Anthropic’s own guidance leans hard on that point. The company’s recommendation is to use bypass modes only inside isolated containers or VMs, where the blast radius of a bad deletion command is contained.