How do I sandbox Claude Code when running it in YOLO mode?

Summary

• YOLO mode usually means Claude Code's --dangerously-skip-permissions flag, which is equivalent to --permission-mode bypassPermissions: tool calls run without permission prompts, so protection has to come from an isolation boundary around Claude Code.
• Claude Code's docs say to run these sessions inside a container, a VM or the sandbox runtime, so file tools, MCP servers and hooks are inside the boundary. Its built-in Bash sandbox covers shell commands only.
• Omnigent's Omnibox sandbox (open source, "Status: alpha") wraps Claude Code, Codex or a custom agent with kernel-enforced filesystem and network rules, so a prompt-injected agent can't opt out.
• Native Windows offers neither Claude Code's Bash sandbox nor Omnigent's filesystem and network isolation, so use WSL2, a container or a VM there.

How do I sandbox Claude Code when running it in YOLO mode?

Put the whole Claude Code process inside an isolation boundary before you remove the prompts. In YOLO mode Claude Code stops asking before most tool calls, so the boundary is the control: a dev container, a custom container, a VM, Claude Code's sandbox runtime, or an OS sandbox such as Omnigent's Omnibox. Then keep secrets and open network access out of that boundary.

What does YOLO mode turn off?

--dangerously-skip-permissions is equivalent to --permission-mode bypassPermissions. That mode disables permission prompts and safety checks so tool calls execute immediately, including writes to protected paths, and Claude Code's docs warn that it offers no protection against prompt injection or unintended actions. A few controls still hold:

• Deny rules block in every mode, and explicit ask rules still prompt.
• On Linux and macOS, Claude Code refuses to start in this mode as root or under sudo, unless it's inside a recognized sandbox.
• Administrators can block the mode by setting permissions.disableBypassPermissionsMode to "disable" in managed settings.

Don't confuse YOLO mode with dangerouslyDisableSandbox. That's the parameter Claude uses to retry a failed command outside the Bash sandbox, and in bypassPermissions mode the retry runs without a prompt.

Which isolation options fit an unattended run?

Option	What's inside the boundary	Enough for YOLO mode?
Sandboxed Bash tool (/sandbox)	Bash, PowerShell and Monitor commands and their child processes	No: file tools, MCP servers and hooks run on the host
Sandbox runtime (beta research preview)	The whole Claude Code process	Yes, launched with npx @anthropic-ai/sandbox-runtime claude
Dev container	The full development environment	Yes; the reference container adds a firewall
Custom container or VM	The full environment or operating system	Yes
Omnigent Omnibox	Agent terminals, OS tools and the processes they spawn	Yes, on Linux and macOS

Layer them. Inside a container or VM, also turn on the Bash sandbox in strict mode in Claude Code's settings, so Claude can't retry a command unsandboxed and won't start if the sandbox can't run:

{
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "allowUnsandboxedCommands": false
  }
}

A container doesn't make secrets safe. Claude Code's dev container docs warn that with --dangerously-skip-permissions, a malicious project can exfiltrate anything inside the container, including the Claude Code credentials in ~/.claude. Use trusted repositories, and don't mount host secrets such as ~/.ssh or cloud credential files.

How does Omnigent's Omnibox sandbox Claude Code?

Omnibox is the OS-level sandbox in Omnigent, the open-source meta-harness for Claude Code, Codex, Cursor, OpenCode, Hermes, Pi and custom agents. Its docs say it wraps any agent "so you can run it unattended, in YOLO mode, without handing it your real credentials, file system, or network". The kernel enforces the rules (bubblewrap and seccomp on Linux, Seatbelt on macOS), and every process the agent spawns inherits the boundary.

• Filesystem: the agent sees only the paths you grant. Even cwd is read-only until you opt it back in, and dotfiles are masked.
• Network: with egress_rules, HTTP(S) traffic goes through a default-deny proxy, and private IPs and cloud metadata endpoints are blocked by default.
• Credentials: the agent holds a placeholder token, and the proxy swaps in the real secret only for allowed requests.

omnigent claude runs Claude Code in an Omnigent session, and the native terminal wrapper puts that terminal in a bwrap sandbox on Linux, where the isolation is mandatory, or in Seatbelt on macOS. For a YAML agent, os_env.sandbox sets the boundary for its OS tools and declared terminals:

name: sandboxed_coder
prompt: You are a coding agent. Inspect files before editing.
executor:
  harness: claude-sdk
os_env:
  type: caller_process
  cwd: .
  sandbox:
    write_paths: [.]
    allow_network: true
    egress_rules:
      - "* pypi.org/**"
      - "GET api.github.com/repos/myorg/**"

If the sandbox can't be provided, Omnigent errors instead of running unsandboxed. MCP servers that Omnigent's runner spawns sit outside the OS sandbox, so constrain them in their own configuration. Policies such as ask_on_os_tools and cost_budget add tool-call gates on top, and native terminal sessions get the same policy layer.

How does Databricks approach sandboxed coding agents?

On Databricks, Omnigent is in Beta, and its managed Sandbox host runs on Databricks Sandbox (Beta). Databricks Sandbox runs untrusted code in an isolated environment with a persistent home directory, and models route through Unity Gateway, so there are no model API keys to manage on the host. Network egress from a Databricks Sandbox is unrestricted and not configurable, so treat it as compute isolation, not a network boundary.

FAQs

Does the Bash sandbox alone make YOLO mode safe?

No. It constrains shell commands only, and Claude Code's docs say it isn't sufficient for fully unattended runs.

Is auto mode an alternative?

Auto mode replaces prompts with a classifier that reviews actions. It's a per-action control, not an isolation boundary, so a sandbox still adds defense in depth.

What should I do on native Windows?

Claude Code runs commands unsandboxed on native Windows, and Omnigent's Job Object backend doesn't isolate the filesystem or network. Run Claude Code in WSL2, a container or a VM.