SecurityThe briefing
AI-generated illustration
Anthropic's Claude Code v2.1.311 introduces CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS, removing the final guardrails on commands like rm. The change follows the earlier --dangerously-skip-permissions flag and bypassPermissions mode.
Anthropic released Claude Code v2.1.311 with a new environment variable that disables remaining permission prompts for agent actions. The variable is named CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS and must be set to 1 in the shell. It extends the earlier bypassPermissions mode introduced in v1.0.18.
The new setting removes the last automatic blocks that still required user approval, such as rm and rmdir commands. Anthropic staff member Daisy Hollman confirmed the variable works as described and is not a joke. Other managed settings may still impose limits.
Auto mode remains the default and runs background safety checks. BypassPermissions mode skips those checks. The variable eliminates the final prompt layer that previously protected against destructive file operations.
Anthropic has documented cases of AI agents issuing rm -rf ~ commands that wipe drives. The company states the variable name is memorable because it mirrors the existing --dangerously-skip-permissions flag.
Builders integrating Claude Code agents must decide whether to expose the new environment variable in their deployment scripts or CI pipelines. A conditional scenario: a developer testing an autonomous data-cleanup agent on a staging server sets the variable to allow rm operations without prompts. The integration decision hinges on whether the agent's task list includes file deletion and whether the environment is isolated. Unknowns include how the variable interacts with enterprise managed settings and whether future releases will add logging when it is active. The evidence does not establish default behavior when the variable is unset.
Operators reviewing agent deployments must assess data-loss exposure before enabling the variable in production or shared environments. A conditional scenario: a team running Claude Code for routine log rotation considers setting the variable on a dedicated VM after confirming no other processes share the filesystem. The eligibility check requires verifying that the deployment does not fall under any managed policy that overrides the variable. The evidence does not establish whether Anthropic logs use of the variable or provides audit trails for compliance reviews.
Create a test environment that mirrors production file permissions, set the variable to 1, and run a controlled rm command on non-critical files while recording whether the command executes without prompt and whether any background checks still occur. The recorded outcome shows whether the bypass functions as described and informs the decision to restrict the variable to isolated test accounts only.
Source material behind this briefing. Our practical implications are Ashlr’s interpretation.
This briefing was prepared with AI assistance from the linked sources. The analysis may include interpretation; consult the original sources for complete context. Cover artwork is illustrative.
AWS made its Continuum agent generally available. The service finds, validates, and proposes fixes for code vulnerabilities in repositories while checking the AWS environment.
SecurityThe briefing
AI-generated illustration
Nothing merged in Ashlr's public repositories on October 21. Here is the idea behind a phrase that runs through recent pull requests: value-free reports.
SecurityThe briefing
AI-generated illustration
No pull requests merged in Ashlr's public repositories on October 20. Here is the plain-English idea behind the previous day's biggest security change.
