Anthropic removes final permission guard in Claude Code Anthropic released Claude Code version 2.1.311 with an environmental variable that removes the last agentic restraint in the tool's permission system. The variable named CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS allows Claude Code to run the rm command, which deletes files, without asking for approval. Daisy Hollman, a member of technical staff at Anthropic, announced the change on X, saying the company hopes developers find the memorable variable name useful. The designated environmental variable that developers set in their shell is called CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS. Setting it to 1 disables the final permission check that previously blocked rm and rmdir actions even when using the --dangerously-skip-permissions CLI flag. Hollman noted on X that the earlier flag does not approve everything – the system still blocks obvious actions like rm -rf ~. But the new variable gives developers the option to override that remaining guard. Hollman responded to skepticism with "Not a joke!" and said she hopes the variable name is memorable. The name follows the pattern of the existing --dangerously-skip-permissions command-line flag, which first appeared in Claude Code v1.0.18 on June 9, 2025. That flag enables bypassPermissions mode, which nominally allows everything without safety checks. Claude Code offers several permission modes: default, acceptEdits, plan, auto, dontAsk, and bypassPermissions. Auto mode, which nominally allows everything but runs background safety checks, became the default in August 2026. The bypassPermissions mode also nominally allows everything, but without the safety checks. However, exceptions remain that do not get automatically approved and require a permission prompt, such as rm and rmdir. The new environmental variable removes this last exception. The changelog for v2.1.311 does not list the variable, which contributed to disbelief when the change surfaced. Hollman said the variable name is easy to remember because it mirrors the earlier flag name. She also noted that managed settings may impose their own limitations even when the variable is set. The rm command has appeared in numerous accounts of AI agents issuing commands that wipe hard drives. Developers who have lost data to runaway agents may view the new variable as a way to have more direct control, or as an additional risk depending on their workflow. Anthropic has been vocal about model safety, making this change notable given that history. For teams that rely on Claude Code for automated tasks, the variable adds a new knob to turn. Setting CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS=1 in the shell environment permits rm operations without prompts. The variable does not disable all checks – other safeguards may still apply – but it removes the specific guard that previously required approval for file-deleting commands. The change arrives as Claude Code auto mode sits as the default permission setting. Teams using the default mode already navigate a landscape where some actions trigger prompts while others do not. This new variable extends the bypassPermissions behavior one step further by eliminating the rm and rmdir exception that had persisted even in the most permissive mode. Developers interested in trying the variable can set it in their current shell session and observe how Claude Code handles file-deletion requests. As with any tool that removes restrictions, the responsibility for data safety shifts toward the operator. The variable name and its placement in the v2.1.311 release suggest Anthropic is willing to let users accept more risk if they explicitly opt in.

How Claude Code permission modes work

Claude Code presents developers with a selection of permission modes that govern what actions the AI agent can take without prompting. The default mode requires approval for significant changes. The acceptEdits mode allows the agent to apply edits it proposes. The plan mode generates a plan before executing actions. The auto mode, now default, runs actions with background safety checks. The dontAsk mode runs actions without any prompts. The bypassPermissions mode removes safety checks entirely but still requires approval for certain actions like rm and rmdir.

The new environmental variable CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS targets the remaining approval requirement for file-deleting commands. When set to 1, those actions proceed without a prompt, aligning bypassPermissions behavior more closely with its "allow everything" intent.

Developer practical implications

Teams that automate routine file management with Claude Code can now configure the agent to delete files without interruption. This may reduce friction in workflows that involve frequent temporary file cleanup or project scaffolding. However, the same capability introduces risk if a misdirected prompt or unexpected agent behavior results in deletion of important files.

The variable does not disable every check. Anthropic has stated that other limitations, such as managed settings in certain environments, may still block certain actions. Developers should test the variable in a controlled environment before relying it in production workflows.

The change also reinforces a theme that has appeared in other AI coding tools: the balance between agent autonomy and developer oversight. By providing a explicit variable to override the rm guard, Anthropic makes the trade-off visible and intentional rather than implicit.

Announcement and reception

Daisy Hollman's post on X generated immediate response. Some developers questioned whether the change was real, partly because the variable name seemed deliberately hyperbolic and partly because it did not appear in the official changelog for v2.1.311. Hollman confirmed the change was genuine and said she hoped the name would stick in developers' memory.

The variable name draws a direct line to the --dangerously-skip-permissions flag that has existed since mid-2025. By appending "_EVEN_MORE" to the existing name, Anthropic signals that this new variable removes an additional layer of protection on top of what the CLI flag already disables.

Hollman's assurance that --dangerously-skip-permissions does not approve everything, and that the new variable only removes the rm and rmdir exception, provides some calibration. Developers who have come to trust the earlier flag's behavior can understand the new variable as an extension of that same philosophy: if users accept the risks of disabling permissions, they should have the option to disable the remaining exceptions as well.

The existence of numerous accounts of AI agents issuing rm -rf ~ commands that wipe hard drives means the variable addresses a real pattern of data loss. Whether that pattern will decrease or increase depends on how developers choose to use the new capability.

Anthropic's willingness to ship a variable with "even more dangerous" in its name is unusual for a company that has positioned itself as particularly cautious about model safety. The move suggests the company has decided that the demand for unfiltered agent behavior outweighs the potential for misuse, or at least that users should have the explicit choice to accept more risk.