Claude Code
Set defaultMode back to default. Replace Bash(*) with the exact commands you use, one rule each, for example Bash(npm test). Delete the flag from the alias and open a new terminal window.
AI coding agents · Risk · OWASP LLM06 Excessive Agency
Your AI agent can run any command without asking
One line in a settings file, or one flag in a shell alias, and the agent stops asking before it runs a command. Here's that line for each agent, and how to switch it back.
Why it matters
With approvals off, the agent acts on whatever it reads: a README, an issue, a web page or an MCP tool's answer. An instruction hidden in any of them can become a command on your computer, with your access to your files, keys and servers.
Approvals on
- README
- Issue
- Web page
- MCP answer
Approvals off
- README
- Issue
- Web page
- MCP answer
The setting in each agent
| Agent | What switches approvals off | Where |
|---|---|---|
| Claude Code | "defaultMode": "bypassPermissions"an allow rule Bash or Bash(*)claude --dangerously-skip-permissions | ~/.claude/settings.json.claude/settings*.jsonshell profile |
| Codex CLI | approval_policy = "never"sandbox_mode = "danger-full-access"codex --dangerously-bypass-approvals-and-sandbox or codex --yolo | ~/.codex/config.tomlshell profile |
| VS Code | "chat.tools.global.autoApprove": truechat.tools.terminal.autoApprove with a pattern that matches everything"chat.permissions.default": "autoApprove" or "autopilot" | VS Code User/settings.json |
| GitHub Copilot CLI | copilot --allow-all-tools, --allow-all or --yolo"defaultPermissionMode": "allow-all"COPILOT_ALLOW_ALL=true | ~/.copilot/settings.jsonshell profile |
| Cursor | Run Everything"approvalMode": "unrestricted"an allow rule Shell(*)agent --force or --yolo | ~/.cursor/cli-config.jsonshell profile |
| Gemini CLI · Amazon Q | gemini --yoloq --trust-all-tools | shell profile |
How to switch it back
Codex CLI
Set sandbox_mode to workspace-write: Codex then writes only inside the project and asks for the rest. Set approval_policy to on-request.
VS Code · Copilot
Remove the auto-approve setting, or list only the exact commands it may run; the editor asks before the rest. In the Copilot CLI, set "defaultPermissionMode": "manual" and "permissions": { "disableBypassPermissionsMode": "disable" }.
Cursor
Pick Allowlist, not Run Everything; set "approvalMode": "allowlist". Replace Shell(*) with the few programs you allow, for example Shell(git): Shell(x) allows x with any arguments, so never a shell or an interpreter like bash or python3.
NeuroShield reads these files for you
Every agent's settings, each project they work in and your shell profiles. For what it flags, it shows the file and the line, and where a safe fix exists, Fix It for Me makes it after you confirm, with Undo. Each agent's guide says exactly what it reads.
Questions
Is auto mode the same as bypass?
No. In Claude Code's auto mode a classifier still checks commands and network requests before they run. Bypass skips the checks.
I trust my agent. Why does it matter?
The risk isn't the agent, it's what the agent reads. Approvals are the moment you see a command before it runs.
See your own agents
The check is free: how many agents you have and what they can do. Details and fixes come with Shields.