Codex YOLO Mode: Run Without Approvals Safely

Codex YOLO Mode: What It Actually Changes

Codex YOLO (You Only Live Once) mode is the risky way to run the Codex CLI when you want the agent to keep working without approval prompts. It’s shorthand for a setup where the agent has broad local access and doesn’t stop to ask before running commands.

The command is:

codex --sandbox danger-full-access --ask-for-approval never

That combination matters because Codex has two separate controls. The sandbox mode controls what commands can access. The approval policy controls when Codex must pause and ask before acting. --sandbox danger-full-access removes the usual sandbox boundary. --ask-for-approval never tells Codex not to stop for approval prompts.

OpenAI also documents the --yolo flag, also named --dangerously-bypass-approvals-and-sandbox, for running every command without approvals or sandboxing. The official CLI reference says to use it only inside an externally hardened environment. If you’re not already inside a disposable or tightly controlled environment, this mode is probably too permissive.

The Visual Cue In The Codex YOLO Mode Screenshot

The screenshot below shows the Codex terminal after launch. The key line is permissions: YOLO mode, the indicator that the dangerous/no-approval mode is active.

The command at the top shows the exact launch form: codex --sandbox danger-full-access --ask-for-approval never. If you see permissions: YOLO mode, assume Codex can act quickly and broadly until you stop it.

Who Should Use Codex YOLO Mode

Use Codex YOLO mode only if you are an experienced user who understands the project, the shell, the current working directory, and the credentials available to the process. This is not a good default for learning Codex, looking at an unfamiliar repository, reviewing untrusted code, or working near production infrastructure.

You should know what package-manager scripts do in the repo, which cloud CLIs are installed and authenticated, and whether .env files, SSH keys, API tokens, database credentials, or deployment config are reachable from the session. You should also be comfortable reading git diff after the agent works.

Dangerous Things Codex Can Do In YOLO Mode

In Codex CLI dangerous mode, Codex can do much more damage than in a normal workspace-write session with approvals. The exact blast radius depends on your machine and config, but the risk categories are clear:

• Modify, overwrite, or delete files in places available to the process.
• Run shell commands without pausing for confirmation.
• Execute package-manager scripts such as npm, pnpm, pip, bundle, cargo, or project-specific scripts.
• Rewrite git history if asked, or if a command it runs does so.
• Touch additional directories exposed by the current user or by Codex configuration.
• Use network access if this mode or the environment allows it.
• Read secrets available through environment variables, local config, credential files, or mounted directories.
• Run destructive database, deployment, cloud, or infrastructure commands if those tools are installed and authenticated.
• Follow malicious instructions embedded in untrusted project files, docs, webpages, or tool output.
• Make many changes before a human notices the direction is wrong.

That last point is underrated. Approval prompts aren’t only a security feature; they’re also pacing. They force you to notice when the agent crosses a boundary. YOLO mode removes that pacing.

Safer Alternatives To Codex YOLO Mode

For most local development, use the safer sandbox mode with on-request approvals:

codex --sandbox workspace-write --ask-for-approval on-request

That lets Codex edit and run routine commands inside the workspace, while still asking when it needs to cross the boundary. If you want planning without changes, use read-only AI coding agent permissions. If you want automation, isolate it.

A safer pattern looks like this:

1. Create a throwaway branch.
2. Run in a disposable VM, dev container, or sandboxed machine.
3. Remove production credentials from the environment.
4. Avoid exposing your home directory or unrelated repositories.
5. Keep cloud CLIs logged out unless the task needs them.
6. Let Codex work on a narrow task, then inspect git diff before continuing.
7. Run tests yourself before merging or deploying.

YOLO mode can be useful in a hardened environment where the agent runs many commands without friction. It is a poor fit for a normal laptop session with broad credentials and a messy working tree.

How To Think About AI Coding Agent Permissions

The right mental model is not “Codex is trusted now.” The right model is “I moved the trust boundary outside Codex.” If you run Codex with danger-full-access and ask-for-approval never, your safety has to come from the surrounding environment: container limits, VM snapshots, branch isolation, credential isolation, network policy, and human review after the run.

If the environment is not hardened, do not compensate with hope. Use safer AI coding agent permissions and keep approval prompts interactive.

Related

Claude Code has a similar YOLO-style workflow through claude --dangerously-skip-permissions. See the companion article: Claude Code YOLO Mode: Using –dangerously-skip-permissions.

For official reference, see OpenAI’s Codex agent approvals and security documentation.

Start publishing for free

Connect this AI to Revdoku so it can store files, create, update, and publish websites for me. Read and follow https://revdoku.com/prompt.md. For ChatGPT, Claude, or another cloud AI, connect https://app.revdoku.com/mcp and complete Revdoku OAuth. For a local agent, use Revdoku's browser device sign-in and complete the connection in Revdoku. Never ask me for a password or API key in chat. When Revdoku tools are connected, verify the connection, tell me you’re ready, and ask what I want to publish.

Copy Prompt

or

Create Free Account