Anthropic 现允许 Claude 用户“不带降落伞跳伞”

认识一下 CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS

一向热衷于强调模型安全的 Anthropic，这次为使用 Claude Code 的开发者提供了一个将安全护栏彻底抛到九霄云外的机会。该公司最新的 Claude Code 构建版本（v2.1.311）支持一个全新的环境变量，旨在允许 AI Agent 在无需征求确认的情况下执行用于删除文件的 rm 命令。

该专用环境变量（开发者在其 Shell 中设置的值）名称为：

CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS

Anthropic 技术团队成员 Daisy Hollman 在一条社交媒体帖子中宣布了这一变化。

“冷知识：--dangerously-skip-permissions 实际上并没有批准所有事情——我们仍然会拦截一些显而易见的高危操作，比如 rm -rf ~，”她写道。“但今天的版本允许你在确实需要时禁用这层限制，只需设置一个新的环境变量 CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS=1 即可。”

并非所有人都相信 Hollman 的话，这或许是因为变量名称过于荒谬，也可能是因为该改动并未列在 v2.1.311 的更新日志（changelog）中。但她向大家确认这是真实存在的。

“这不是开玩笑！”她回复道，“希望这对大家有帮助，也希望这个变量名足够让人印象深刻。”

这个名字确实很容易记住，因为它与前文提到的 Claude Code 标志 --dangerously-skip-permissions 非常相似。该命令行标志可启用 bypassPermissions 模式，该模式最早出现于 2025 年 6 月 9 日发布的 Claude Code v1.0.18 中。

Claude Code 提供多种权限模式：default、acceptEdits、plan、auto、dontAsk 以及 bypassPermissions。其中 auto 模式在名义上允许所有操作但在后台运行安全检查，并在 8 月成为了默认模式；bypassPermissions 模式同样名义上允许所有操作，但不会运行任何安全检查。

然而，此前仍有一些例外情况不会获得自动批准，且必须弹出权限提示，例如 rm 和 rmdir。

全新的 CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS 环境变量彻底消除了这道最后的 Agent 约束，尽管像托管设置（managed settings）等其他配置可能仍会施加它们自有的限制。

值得一提的是，网络上已有大量案例记录表明，AI Agent 曾因执行类似 rm -rf ~ 的命令而抹掉整个硬盘数据，或引发其他导致数据丢失的惨剧。但正如那句俗话所说：人生只有一次，放手一搏吧。

ai and ml

Anthropic now lets Claude users jump out of plane without parachute

Meet CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS

Anthropic, prone to pronouncements about model safety, has given developers using Claude Code the opportunity to throw its guardrails out the window. The company's latest Claude Code build (v2.1.311) supports an environmental variable designed to allow the AI agent to run the rm command, which deletes files, without asking for approval.

The designated environmental variable (a value developers set in their shell) is called:

CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS.

Daisy Hollman, a member of technical staff at Anthropic, announced the change in a social media post.

"Fun fact: --dangerously-skip-permissions doesn't actually approve EVERYTHING – we still block some obvious things like rm -rf ~," she wrote. "But today's release will let you disable this if you really want, by setting a new env var CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS=1"

Not everyone believed Hollman, perhaps due to the absurdity of the variable name or because the change isn't listed in the v2.1.311 change log. But she offered reassurance that it's real.

"Not a joke!" she responded. "I hope this helps, and I hope the variable name is memorable."

The name is easy to remember because it is very much like the aforementioned Claude Code flag --dangerously-skip-permissions. That command line flag enables bypassPermissions mode, which first surfaced in Claude Code v1.0.18, on June 9, 2025.

Claude Code has several permission modes: default, acceptEdits, plan, auto, dontAsk, and bypassPermissions. Auto mode, which nominally allows everything but runs background safety checks, became the default in August; bypassPermissions also nominally allows everything, without the safety checks.

But there are still exceptions that do not get automatically approved and require a permission prompt, such as rm and rmdir.

The new CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS environmental variable removes this last agentic restraint, though other things like managed settings may impose their own limitations.

It's perhaps worth noting that there are numerous accounts of AI agents issuing commands like rm -rf ~ that wipe hard drives or take other action that results in data loss. But as they say, you only live once. ®