Codex has no dangerously
skip permissions flag.
Codex has no --dangerously-skip-permissions; that flag belongs to Claude Code. The Codex equivalents are codex --dangerously-bypass-approvals-and-sandbox (alias --yolo), which drops approvals and the sandbox together, and approval_policy = "never", which stops it asking at all. Codex decides who approves a command with two config keys. approval_policy takes untrusted, on-request or never, and also accepts a granular table. approvals_reviewer takes user or auto_review, and defaults to user; auto_review hands eligible prompts to the reviewer subagent, so a model approves instead of a person. sandbox_mode is separate and takes read-only, workspace-write or danger-full-access. Pushary keeps approval_policy asking and routes those prompts to your phone, so the human stays in the loop without you sitting at the terminal.
The flag
codex --dangerously-bypass-approvals-and-sandbox (alias --yolo)The nearest thing Codex has to Claude Code's flag: it drops approvals and the sandbox together. approval_policy = "never" removes only the prompts, and approvals_reviewer = "auto_review" keeps them but lets the reviewer subagent answer.
Featured on Hacker NewsWhat each setting actually turns off
approval_policy = untrusted asks before anything Codex does not already trust. on-request lets the model ask when it judges a command needs review. never stops it asking at all, which is the setting people reach for when they want an unattended run and the one that quietly removes the human. The granular table splits that further across sandbox_approval, rules, mcp_elicitations, request_permissions and skill_approval. approvals_reviewer is the key most people miss: leave it at user and prompts come to you, set it to auto_review and the reviewer subagent answers them. sandbox_mode is a separate axis, read-only, workspace-write or danger-full-access, and the --yolo flag collapses both axes at once.
Why people use it, and the real risk
Two of these settings look cautious and still leave nobody watching. approvals_reviewer = auto_review reads as the responsible middle option, but the thing reviewing the command is a model, so a prompt injection that fools the agent has a fair chance of fooling its reviewer too. approval_policy = never is the honest version of the same outcome. With the sandbox also dropped, Codex will run rm, git reset --hard, force pushes, package installs and curl piped to a shell with no chance to stop it, and a poisoned README or dependency can steer it there. Neither setting leaves a record you can read afterwards: there is no per-command log of what a human sanctioned, because no human sanctioned anything.
Three ways to run an agent
Full bypass keeps the agent moving but drops the gate. Babysitting keeps the gate but pins you to the keyboard. A phone gate keeps both.
| Approach | Agent keeps moving | Destructive actions gated | Away from the keyboard | Audit trail |
|---|---|---|---|---|
| Full bypass (Codex) | ||||
| Babysit the terminal | ||||
| Pushary phone gate |
The safer alternative
Leave approval_policy on untrusted or on-request, leave approvals_reviewer at user, and keep sandbox_mode at workspace-write or read-only so writes stay scoped. The reason people move off that setup is not that they want less safety, it is that they do not want to sit at the terminal. Pushary solves that half instead: a PreToolUse hook classifies the call, safe read-only commands clear automatically, and anything riskier pushes to your phone and holds the command until you answer. You get the unattended run without handing the decision to a subagent, and every question and answer is written to a log you can replay. That is the difference between nobody was watching and a human approved the delete at 2:14pm.
Codex skip permissions questions
Does Codex have --dangerously-skip-permissions?
No. It is a Claude Code flag, and Codex rejects it with error: unexpected argument '--dangerously-skip-permissions' found. Read the tip Codex prints next carefully, because it suggests --dangerously-bypass-hook-trust, which is a different flag about trusting hooks and is not what you want. Codex splits the idea across two axes instead. To drop approvals and the sandbox in one go, use codex --dangerously-bypass-approvals-and-sandbox, which also accepts --yolo. To drop only the approval prompts, set approval_policy = "never" in config.toml or pass --ask-for-approval never. To drop only the isolation, set sandbox_mode = "danger-full-access". The nearest single equivalent to Claude Code's flag is the bypass flag, because it is the one that removes both at once.
What is the difference between auto_review and full access?
They sit on different keys and are often confused. approvals_reviewer = auto_review keeps approval prompts switched on and hands them to the reviewer subagent, so a model answers instead of you. sandbox_mode = danger-full-access is about isolation, and removes the filesystem and network boundary regardless of who is approving. You can run auto_review inside a tight sandbox, or run full access with a human still approving. The setting that removes the person is approvals_reviewer, not the sandbox one.
Codex approves things for me even though I did not ask it to. Why?
Check approvals_reviewer before anything else. It defaults to user, but once it is set to auto_review the reviewer subagent answers eligible prompts under on-request and granular policies, and from the outside that looks exactly like Codex approving on its own. The other cause is approval_policy = never, which stops the prompt existing at all. Set the first back to user and the second to untrusted or on-request, then use a phone gate so you can still leave the desk.
How do I run Codex CLI unattended safely?
Run it in a throwaway container or VM if you use the bypass flag, never on your real machine with live credentials. A safer setup keeps --sandbox workspace-write and adds a Pushary policy so destructive tools (deletes, force pushes, network calls) pause and send a push you approve from your phone, while everything else proceeds. You keep the speed and get an audit trail of exactly what a human approved.
Run Codex unattended without skipping every permission.
Keep the agent moving, gate the risky calls, approve from your phone. Set up in two minutes.