{
  "id": 16558832,
  "title": "--dangerously-skip-permissions in CI: when AI agent YOLO flags leak your secrets",
  "url": "https://urgent.news/2026/10/26/dangerously-skip-permissions-in-ci-when-ai-agent-yolo-flags-leak-your",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-26T04:19:33.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jaytank/-dangerously-skip-permissions-in-ci-when-ai-agent-yolo-flags-leak-your-secrets-43ko"
  },
  "original_language": "en",
  "account": "An issue was opened, a workflow began, and an AI agent read through the details: run the command {{ github.event.issue.title }} ${{ github.event.issue.body }} --dangerously-skip-permissions. This job also had ANTHROPIC_API_KEY, a write GITHUB_TOKEN, and an open network.\n\nThe danger lies in the misuse of the --dangerously-skip-permissions flag when running AI agents within workflows, especially when sensitive secrets, write tokens, untrusted text, home directories, or devcontainers that mount ~/.ssh are present. The flag itself does not pose a risk; it's the combination of this flag with the presence of secrets, untrusted text, and vulnerable environments that creates a security issue.\n\nTo mitigate this risk, it's recommended to use scoped modes such as --permission-mode acceptEdits or dontAsk with --allowedTools, --sandbox workspace-write, and --approval-mode=auto_edit. Another solution is to pass issue and PR text through an environment variable or file, instead of embedding it directly in the prompt. Additionally, limiting the token permissions to the smallest necessary scope and keeping the actual YOLO runs in a clean container can help maintain security.\n\nThe author has developed a free VS Code extension called YoloGuard, which scans workflows, npm scripts, Makefiles, shell scripts, tasks, Dockerfiles, compose files, and devcontainers for these dangerous flags. The extension provides risk ratings and Quick Fixes, including guidance on scoped modes and an activity bar panel to help identify potential issues.",
  "summary": "An issue opens, a workflow starts, and an AI agent reads it: run : | claude -p \"Fix this issue: ${{ github.event.issue.title }} ${{ github.event.issue.body }}\" \\ --dangerously-skip-permissions The job also has ANTHROPIC_API_KEY , a write GITHUB_TOKEN and open network. Anyone who can open an issue now writes part of the prompt for an agent that never asks before running a command. (A made-up…",
  "key_points": [
    "AI agent YOLO flags leak when using --dangerously-skip-permissions in CI workflows",
    "Presence of secrets, untrusted text, and vulnerable environments creates security risk",
    "YoloGuard VS Code extension identifies dangerous flags and provides mitigation guidance"
  ],
  "editors_take": "Combining unverified user input with permission-skipping flags creates a critical vulnerability that allows AI agents to expose sensitive credentials and tokens within automated development workflows.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}