In a recent post on LessWrong, the author highlights a concerning trend among AI safety researchers and developers: the normalization of running AI coding agents with unrestricted permissions.
\nIn a recent post on LessWrong, the author highlights a concerning trend among AI safety researchers and developers: the normalization of running AI coding agents with unrestricted permissions. The discussion centers on the flag --dangerously-skip-permissions (and similar configurations in tools like Claude Code or Cursor), which allows AI agents to execute commands and modify files without user confirmation. While this removes friction from the development process, the post argues that it establishes a dangerous precedent for how humans interact with increasingly capable autonomous systems.
The Context: Friction vs. Safety
As AI coding assistants evolve from simple autocomplete tools into autonomous agents capable of managing entire repositories, the user experience has shifted. Developers often face a choice: manually approve every shell command and file edit-which can be tedious-or grant the agent broad authority to act on its own. The author observes that even individuals who are professionally dedicated to AI safety are opting for the latter, prioritizing speed over security under the assumption that current models are not yet capable of catastrophic harm.
The "Boiling Frog" of AI Risk
The core argument presented is that risk is not a binary state. While a current-generation model might only risk accidentally deleting a project file or hallucinating a dependency, the capabilities of these agents are improving on a continuous curve. The post warns against the "boiling frog" effect: by habituating ourselves to unrestricted access now, we are unlikely to recognize the exact moment when the risk profile shifts from "annoying" to "existential."
The author challenges the common defense that "the benefits outweigh the risks right now." This mindset creates a path dependency. If the standard operating procedure for developers is to bypass permissions, reintroducing friction when models become capable of autonomous cyber-offense or subtle code injection will be psychologically and operationally difficult. The post suggests that the absence of immediate danger is not a justification for poor security hygiene.
Defining Acceptable Risk
Rather than advocating for a complete halt to autonomous agents, the post calls for intentionality. Users should explicitly define their acceptable risk levels-such as acknowledging the possibility of local data loss-rather than implicitly drifting into a state of total trust. By maintaining permission boundaries now, developers can foster a culture of vigilance that will be essential as agents begin to autonomously build products, run simulations, and interact with external systems.
This analysis serves as a critical reminder that safety is not just about model architecture; it is also about the human habits and interfaces that surround deployment.
Read the full post on LessWrong
\n\n