Anthropic, a company that over the past few years has positioned its models as an industry standard where AI safety is the top priority, has introduced a tool in the current Claude Code v2.1.311 build that allows developers to effectively disable remaining safety mechanisms. We are talking about a new environment variable, CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS, which, when set to '1', allows the AI agent to execute file deletion commands without asking the user for confirmation. Anthropic technical specialist Daisy Hollman publicly announced the new feature, and judging by the reaction on the social network X, her statement was initially taken as a joke — she had to publicly insist that the feature is real.
How the permission system works in Claude Code
To understand the scale of the change, it is important to examine the permission architecture built into Claude Code. The tool supports several modes: default, acceptEdits, plan, auto, dontAsk, and bypassPermissions. The command-line flag --dangerously-skip-permissions, which activates the bypassPermissions mode, appeared back in version v1.0.18 on June 9, 2025. Since August, the auto mode has been set by default, which formally allows any actions while running background security checks. The bypassPermissions mode also formally allows everything, but without background checks — however, it retains exceptions that are not automatically approved and require explicit confirmation, specifically the execution of rm and rmdir commands.
What the new variable actually removes
The new environment variable CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS removes this very last restriction remaining in the bypassPermissions mode. According to Hollman, the existing --dangerously-skip-permissions flag largely removes safety mechanisms, but does not allow doing absolutely everything — for example, executing without confirmation the rm -rf ~ command, which deletes the entire contents of a Linux user's home directory. This is precisely the «final barrier» that the new tool removes. At the same time, Hollman notes that other mechanisms, such as user-defined settings, can still impose their own restrictions, meaning complete «freedom of action» for the agent is not guaranteed automatically.
Context: safety image and real risks
The appearance of such a tool looks paradoxical against the backdrop of Anthropic's public stance, which traditionally makes loud statements about artificial intelligence model safety. The practical significance of the feature is underlined by the fact that open sources contain numerous cases where AI agents executed commands like rm -rf ~, leading to complete disk data loss and other severe consequences for users. Thus, the company is effectively providing developers with a tool capable of disabling protection against the most destructive autonomous agent work scenario in a single step.
Community reaction
Not all users on social network X took Hollman's statement seriously, and she had to publicly insist she was not joking. The very fact that the feature was announced by a company employee and requires confirmation points to its reality in the current v2.1.311 build. For developers working with Claude Code in automated pipelines, this means a new level of control — and new responsibility: now the decision of whether the agent can delete files without confirmation lies entirely with the user who sets the corresponding environment variable.
