# Running YOLO-Mode Coding Agents in a Sandbox for Infrastructure Work

DevFeed: [Running YOLO-Mode Coding Agents in a Sandbox for Infrastructure Work](<https://devfeed.tech/articles/yolo-mode-is-the-right-default-your-laptop-is-the-wrong-place-for-it-19025.md>)

Original publisher: [Read original article](<https://www.pulumi.com/blog/sandboxing-coding-agents-yolo-mode/>)

Author: Engin Diri

Published: 2026-08-04T00:00:00Z

Content type: opinion

Language: en

Sources: [Pulumi](<https://devfeed.tech/sources/pulumi.md>)

Topics: [Claude Code](<https://devfeed.tech/topics/claude-code.md>), [Security](<https://devfeed.tech/topics/security.md>), [coding](<https://devfeed.tech/topics/coding.md>), [Claude](<https://devfeed.tech/topics/claude.md>), [Filesystems](<https://devfeed.tech/topics/filesystems.md>), [codex](<https://devfeed.tech/topics/codex.md>), [cursor](<https://devfeed.tech/topics/cursor.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [autonomous](<https://devfeed.tech/tags/autonomous.md>), [aws](<https://devfeed.tech/tags/aws.md>), [best-practices](<https://devfeed.tech/tags/best-practices.md>), [claude](<https://devfeed.tech/tags/claude.md>), [claude-code](<https://devfeed.tech/tags/claude-code.md>), [codex](<https://devfeed.tech/tags/codex.md>), [coding](<https://devfeed.tech/tags/coding.md>), [cursor](<https://devfeed.tech/tags/cursor.md>), [docker](<https://devfeed.tech/tags/docker.md>), [files](<https://devfeed.tech/tags/files.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [infrastructure-as-code](<https://devfeed.tech/tags/infrastructure-as-code.md>), [permission](<https://devfeed.tech/tags/permission.md>), [sandbox](<https://devfeed.tech/tags/sandbox.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This opinion article argues that coding agents should retain autonomous YOLO-mode operation inside a sandbox rather than rely on repeated command approvals. It discusses risks to local files, AWS credentials, Kubernetes configurations, and Pulumi access tokens, and presents sandboxing as a way to limit the blast radius during infrastructure work.

## Source excerpt

Claude Code calls the flag --dangerously-skip-permissions, and the community long ago renamed it YOLO mode. It lets your coding agent run any command it wants without ever asking for permission. Every agent has some version of it, Codex and Cursor included, and if you use these tools seriously, you are probably running one of them every day. I am. YOLO mode is also what makes a coding agent worth having. An agent that stops for approval before every command is not autonomous; it's a slow pair programmer. But you cannot let it run wild on your machine without real guardrails either. You have heard the horror stories: wiped databases, deleted home directories, vanished git history. The odds on any given day are low, and it's tempting to conclude it will never happen to you. It only has to happen once. My version of this problem is worse than most, because the code in my working directory is infrastructure code. My laptop holds more than source files. It holds AWS credentials, kubeconfigs that point at real clusters, and Pulumi access tokens. This post walks through what an unsandboxed agent can actually do, why prompt guardrails fail exactly when you need them, and how a sandbox lets you keep full YOLO-mode autonomy anyway. Then I will show you the kit I built for doing infrastructure work this way. Approving every command is not a security model Let me get one thing out of the way first: the answer is not to turn YOLO mode off. A real working session involves hundreds of commands, and nobody reviews the hundredth npm install any better than the first. You are not evaluating at that point; you are pressing enter. Approval fatigue turns the permission prompt into a formality while destroying the one thing you wanted from the agent, which is that it works while you do something else. The goal instead is to run YOLO mode somewhere it cannot hurt you. That somewhere is a sandbox: an isolated environment where the agent has full autonomy and your machine is no longer part