Codex has no dangerously
skip permissions flag.
Codex has no --dangerously-skip-permissions; that flag belongs to Claude Code. The Codex equivalents are codex --dangerously-bypass-approvals-and-sandbox (alias --yolo), which drops approvals and the sandbox together, and approval_policy = "never", which stops it asking at all. Codex decides who approves a command with two config keys. approval_policy takes on-request or never, and also accepts a granular table; the old untrusted value is retired and can stop Codex from starting. approvals_reviewer takes user or auto_review, and defaults to user; auto_review hands eligible prompts to the reviewer subagent, so a model approves instead of a person. sandbox_mode is separate and takes read-only, workspace-write or danger-full-access. Pushary keeps approval_policy asking and routes those prompts to your phone, so the human stays in the loop without you sitting at the terminal.
Updated
The flag
codex --dangerously-bypass-approvals-and-sandbox (alias --yolo)The nearest thing Codex has to Claude Code's flag: it drops approvals and the sandbox together. approval_policy = "never" removes only the prompts, and approvals_reviewer = "auto_review" keeps them but lets the reviewer subagent answer.
Featured on Hacker NewsWhat each setting actually turns off
on-request lets the model ask when it judges a command needs review. The old untrusted value is retired and can stop Codex from starting. To keep its rule, asking before anything Codex does not already trust, leave approval_policy unset and set trust_level = "untrusted" for the project in ~/.codex/config.toml. never stops it asking at all, which is the setting people reach for when they want an unattended run and the one that quietly removes the human. The granular table splits that further across sandbox_approval, rules, mcp_elicitations, request_permissions and skill_approval. approvals_reviewer is the key most people miss: leave it at user and prompts come to you, set it to auto_review and the reviewer subagent answers them. sandbox_mode is a separate axis, read-only, workspace-write or danger-full-access, and the --yolo flag collapses both axes at once.
What Approve for me (Auto-review) does
Approve for me is what the ChatGPT desktop app and the IDE extension call Auto-review, the same setting as approvals_reviewer = "auto_review" in ~/.codex/config.toml. Every approval stays on, and a reviewer subagent answers it instead of you. That covers the requests that would have stopped for you: a sandbox escalation, a blocked network call, an edit outside the writable folders, or a side-effecting MCP call. Actions that stay inside the sandbox are not reviewed at all.
Under OpenAI's policy, low and medium risk actions can proceed when policy allows them, critical risk actions are denied, and high risk ones need your authorization. A review that fails or times out does not run the action. After a denial Codex tells the agent to find a materially safer path or stop and ask you, and it ends the turn after 3 denials in a row or 10 in its last 50 reviews.
In the CLI you turn it on with approvals_reviewer = "auto_review" and approval_policy = "on-request", or with -c approvals_reviewer=auto_review for one run, and /approve retries one recent denial. It only works while approvals are interactive: under approval_policy = "never" or with --yolo there is nothing left to review.
Why people use it, and the real risk
Two of these settings look cautious and still leave nobody watching. approvals_reviewer = auto_review reads as the responsible middle option, but the thing reviewing the command is a model, so a prompt injection that fools the agent has a fair chance of fooling its reviewer too. approval_policy = never is the honest version of the same outcome. With the sandbox also dropped, Codex will run rm, git reset --hard, force pushes, package installs and curl piped to a shell with no chance to stop it, and a poisoned README or dependency can steer it there. Neither setting leaves a record you can read afterwards: there is no per-command log of what a human sanctioned, because no human sanctioned anything.
Three ways to run an agent
Full bypass keeps the agent moving but drops the gate. Babysitting keeps the gate but pins you to the keyboard. A phone gate keeps both.
| Approach | Agent keeps moving | Destructive actions gated | Away from the keyboard | Audit trail |
|---|---|---|---|---|
| Full bypass (Codex) | ||||
| Babysit the terminal | ||||
| Pushary phone gate |
The safer alternative
Set approval_policy to on-request, or leave it unset with the project's trust_level at untrusted for the stricter rule, leave approvals_reviewer at user, and keep sandbox_mode at workspace-write or read-only so writes stay scoped. The reason people move off that setup is not that they want less safety, it is that they do not want to sit at the terminal. Pushary solves that half instead: a PreToolUse hook classifies the call, safe read-only commands clear automatically, and anything riskier pushes to your phone and holds the command until you answer. You get the unattended run without handing the decision to a subagent, and every question and answer is written to a log you can replay. That is the difference between nobody was watching and a human approved the delete at 2:14pm.
Codex skip permissions questions
Does Codex have --dangerously-skip-permissions?
No. It is a Claude Code flag, and Codex rejects it with error: unexpected argument '--dangerously-skip-permissions' found. Read the tip Codex prints next carefully, because it suggests --dangerously-bypass-hook-trust, which is a different flag about trusting hooks and is not what you want. Codex splits the idea across two axes instead. To drop approvals and the sandbox in one go, use codex --dangerously-bypass-approvals-and-sandbox, which also accepts --yolo. To drop only the approval prompts, set approval_policy = "never" in config.toml or pass --ask-for-approval never. To drop only the isolation, set sandbox_mode = "danger-full-access". The nearest single equivalent to Claude Code's flag is the bypass flag, because it is the one that removes both at once.
What is the difference between auto_review and full access?
They sit on different keys and are often confused. approvals_reviewer = auto_review keeps approval prompts switched on and hands them to the reviewer subagent, so a model answers instead of you. sandbox_mode = danger-full-access is about isolation, and removes the filesystem and network boundary regardless of who is approving. You can run auto_review inside a tight sandbox, or run full access with a human still approving. The setting that removes the person is approvals_reviewer, not the sandbox one.
Codex approves things for me even though I did not ask it to. Why?
Check approvals_reviewer before anything else. It defaults to user, but once it is set to auto_review the reviewer subagent answers eligible prompts under on-request and granular policies, and from the outside that looks exactly like Codex approving on its own. The other cause is approval_policy = never, which stops the prompt existing at all. Set the first back to user and the second to on-request, not untrusted, which Codex retired and which can stop it from starting. Then use a phone gate so you can still leave the desk.
How do I run Codex CLI unattended safely?
Run it in a throwaway container or VM if you use the bypass flag, never on your real machine with live credentials. A safer setup keeps --sandbox workspace-write and adds a Pushary policy so destructive tools (deletes, force pushes, network calls) pause and send a push you approve from your phone, while everything else proceeds. You keep the speed and get an audit trail of exactly what a human approved.
What does Approve for me do in Codex?
It sends Codex's approval prompts to a reviewer subagent instead of you. Approve for me is the app's name for Auto-review, approvals_reviewer = "auto_review" in config.toml. The sandbox and every approval stay as they were; only the reviewer changes. The app's Full access mode is the other end: it edits any file and runs networked commands without your approval, so there is nothing left to review.
Why does Approve for me keep denying my commands?
The reviewer is built to refuse data exfiltration, credential probing, broad security weakening and destructive actions, and it denies critical risk outright, so a command that touches secrets, deletes a lot or opens the network can be refused even when you meant it. After a denial Codex tells the agent to find a safer path or stop and ask, and three denials in a row end the turn. Run /approve to pick one recent denial and approve it for a single retry; the retry still goes through Auto-review. Users have also reported denials in the desktop app with no /approve to fall back on (openai/codex#48931, #49439). If you want a person to have the last word on those calls, set approvals_reviewer back to user and route the prompts to your phone.
Does Approve for me use up my Codex usage?
It can. OpenAI's docs say automatic review uses extra model calls, so it can add to Codex usage, and local messages share your plan's usage allowance, where weekly limits may also apply. If usage matters, keep approvals_reviewer at user. Pushary sends the same prompts to your phone, and answering them there costs no Codex usage.
Run Codex unattended without skipping every permission.
Keep the agent moving, gate the risky calls, approve from your phone. Set up in two minutes.
Start your trial$9.99/mo after a 3-day free trial. Cancel anytime.