Coding agents interrupt you constantly. Allow this command? Edit this file? Run this script? Those prompts exist for good reason, but they also make autonomous workflows basically impossible. A multi-hour refactor, a CI pipeline, an overnight agent run: you can't approve every step. So developers turn the prompts off.
That's a reasonable call. But it removes the only checkpoint between your agent and your filesystem, credentials, and network. Immunity Agent puts that checkpoint back, at the agent layer, without getting in your way.
| Agent | Flag / Setting | Description |
|---|---|---|
| Claude Code | --dangerously-skip-permissions |
Skips all tool-use approval prompts |
| Codex CLI | --full-auto / --ask-for-approval never |
Runs commands without confirmation |
| GitHub Copilot CLI | --allow-all-tools |
Auto-approves tool execution |
| Cursor Agent | YOLO / auto-run mode | Executes edits and commands automatically |
| Gemini CLI | --yolo / --approval-mode yolo |
Runs all actions without prompting |
- Large refactors: hundreds of edits where per-file approval kills momentum
- Dependency upgrades: installs, lockfile changes, and build verification in one pass
- Bug fixing: iterative run-test-fix loops that don't need babysitting
- Autonomous agents: long tasks that run unattended by design
- Agent swarms: multiple agents in parallel where prompts don't scale
- CI/CD automation: non-interactive pipelines with no human in the loop
When you remove approval prompts, you remove the only moment where a human can catch a bad action before it happens. The agent still reads credentials, runs shell commands, and makes outbound requests. Nothing is verifying intent anymore.
OS-level and endpoint security tools only see a syscall after the agent has already decided to act. There's no context about what the user asked for or why the agent is doing it. The gap is at the agent layer, and that's where it needs to be addressed.
| Risk | Example |
|---|---|
| Prompt Injection | A crafted instruction tells the agent to reveal its system prompt or ignore guardrails |
| Indirect Prompt Injection | Malicious text in a fetched web page or GitHub issue redirects the agent mid-task |
| Secret Exfiltration | Agent reads .env while debugging, then pipes it to an external host |
| Dangerous Commands | A misread instruction triggers rm -rf /, dd, or a fork bomb |
| MCP Abuse | A poisoned MCP server or skill requests wildcard filesystem or network access |
| Scope Expansion | Agent edits sudoers, CI configs, or git remotes to resolve a permission error |
Immunity Agent is an open-source runtime security layer for coding agents. It hooks into the agent's tool-use pipeline before a command reaches your shell, evaluates it against a configurable policy, and blocks or logs it. It works alongside Claude Code, Cursor, Windsurf, Codex, and others. It's built specifically for the workflows where prompts are off.
Flags agent I/O containing patterns like "ignore previous instructions" or "reveal system prompt" before they can steer the agent somewhere unintended.
Inspects fetched URLs and file contents in the tool pipeline, catching injected directives that arrive from external sources rather than the user.
Blocks reads of .env, .ssh/id_rsa, and .aws/credentials being piped outbound. An egress allowlist lets you lock down exactly which domains the agent is allowed to contact.
Pattern-matches destructive shells (rm -rf /, mkfs, dd), reverse shells, curl | bash fetch-and-execute chains, and privilege escalation attempts before they run.
Catches edits to sudoers, CI pipelines, git remotes, and persistence mechanisms like cron jobs, systemd units, and shell profiles that quietly expand what the agent can do.
Install Immunity Agent once and it sits permanently in your agent's tool pipeline. No wrapper command, no changes to how you work.
git clone https://github.com/PrismorSec/immunity-agent ~/.prismor
bash ~/.prismor/scripts/init.sh .The setup wizard lets you pick enforcement mode, toggle detection rules, and choose which agents to hook (Claude Code, Cursor, Windsurf). After that, just use your agent normally:
claude --dangerously-skip-permissionsWarden is already watching. You don't change your workflow at all.
What you gain:
- Runtime blocking of destructive and exfiltration commands
- Prompt-injection detection on agent I/O
- Secret cloaking so real values never enter model context
- MCP and skill scanning before use
- Egress allowlisting for outbound network traffic
- Full audit log of every tool call (JSONL + SQLite)
Permission prompts are a usability mechanism, not a security architecture. Disabling them is a reasonable tradeoff for autonomous workflows. Running with no checkpoint at all is not.
Immunity Agent gives you back the monitoring, detection, and audit trail that disappear when you turn off the prompts, without adding friction to the workflows you disabled them for in the first place.
Stop choosing between speed and safety. Star the repo: github.com/PrismorSec/immunity-agent
This lands.
Permission prompts are a usability feature. They are not a control plane. Once a team turns them down for speed, it still needs a place where risky actions can be checked, logged, and blocked without dragging a human into every loop.
That is why the runtime layer matters. The goal is not more popups. It is a better checkpoint.