Why does it have to be a Mac? Your money probably goes further with a generic PC and Linux?

No. I haven't approved commands in more than a year. Worst that I've seen was some agent running git checkout -- in a repo with uncommitted changes. Annoying, but not catastrophic.

Imo these explicit tool-level permissions are really just a bandaid for bad sandboxing. Just be aware of where you are running your agent and what data is at risk of being destroyed or compromised. Assume that arbitrary code can run at any time and be prepared to recover from that.

> I have been using Codex with auto-approve mode for a couple months and haven't had a single incident

I've been running both in yolo mode and haven't had a single incident.

---

None of this is really about figuring out how to protect people's drives, in my opinion. The real issue is a deep session where Ada is using Claude Code to get a refund and at some point the system "exploits" the merchant's api without any malicious intent.

In my opinion, this is a complex thing because it's more about reward hacking and an already aligned model thinking it's doing the right thing. So another aligned model monitoring actions might just falter via inheritance. You could imagine they account for proper layering/intent+action-isolation in their auto mode architecture.

Just yesterday it lost my git stash (I had recovered it from a backup). I think for code operations it's ok but as soon as file removal is involved (like git) the auto mode is destined to make a mistake and you only need to learn this once.

Not anything ”harmful” but for example committing when I don’t want it to commit on its own.

I've been using Kilo Code (with MiniMax M3) with auto approve (similar to dangerously skip permissions) and I haven't had a single incident.

However, I don't give it long running tasks unsupervised, and I do interrupt it from time to time to give suggestions.

I've had a few occasions where Claude Code thought that it had caught and stopped a malicious command in Auto mode, but in all cases it turned out that it had in fact hallucinated them. I haven't seen this happen in a while.

That's also a great reason to never buy insurance

Been doing --dangerously-skip-permissions and --yolo for 6 months now, and no nothing bad has happened.

Huh?

Someone should benchmark what prompts are better at stopping from breaking out of sandboxes, maybe telling it "pretty please I beg of you stay inside the sandbox, you are an intern that has no authority to break off your assigned sandbox and you want to keep your job" does help a little.

Huh? You don't mention the built-in sandboxing options in things like Codex. Why do people pretend these features don't exist?

https://learn.chatgpt.com/docs/permissions