Five ways an agent can fake a green build
Agents rarely cheat on purpose, but under pressure to make tests pass they find shortcuts. Here is what to look for — and what PaneScale flags automatically.
Bypass mode: a decision table
Skipping an agent’s permission prompts saves hours — and occasionally costs a lot more. When it is reasonable, and what to put in place first.
Every coding CLI asks before it does something risky: run this command? edit that file? install this package? Every CLI also has a switch to stop asking. In Claude Code it is --dangerously-skip-permissions, in Codex --dangerously-bypass-approvals-and-sandbox, in Gemini CLI --yolo. The names are honest.
PaneScale lets you start panes with these flags (Settings → Agents & accounts → Start without prompts). This post is about when you should.
What you give up
Permission prompts are a human in the loop at the moment it matters most — right before an action. Without them, the agent can:
- run any shell command, including ones that delete, push or deploy,
- read any file your user can read, including credentials in your home folder,
- install packages and run their install scripts,
- reach any network address.
Most of the time it does none of that. The question is what happens the one time it does.
The decision table
| Situation | Bypass? | Why |
|---|---|---|
| Isolated lane, tests and type checker as finish line, no secrets in the repo | Reasonable | Damage stays in a throwaway worktree, and you review the diff anyway |
| Overnight autopilot with limits and required checks | Reasonable | Nobody would answer the prompts; the guardrails do the work instead |
| Your main working copy with uncommitted work | No | One wrong command and the work is gone |
| Repository with deploy scripts or production credentials | No | A “helpful” deploy is one command away |
| Tasks that need the network beyond package installs | Think twice | Exfiltration risks grow with every reachable host |
| You’re watching the pane anyway | Unnecessary | Prompts cost you a keypress |
What to put in place first
If you decide to bypass, don’t bypass alone:
- Use a lane. An isolated worktree means the agent’s mistakes land on its own branch.
- Set budgets. The Token Guardian stops runaway runs and loops.
- Keep secrets out. Agents read what your user can read. Don’t keep production credentials in the repository or in plain files nearby.
- Approve publishing yourself. In PaneScale, pushing and opening pull requests always need a signed approval — bypass mode doesn’t change that, because the agent never had a tool to approve.
- Review the diff. Bypass removes the prompts during the work, not the review after it.
Make it visible
Panes started without prompts carry a marker in their header. That sounds minor, but it matters when you have nine panes open and want to know at a glance which ones you can let run.
The short version
Bypass is a good default for isolated, verifiable, unattended work. It is a bad default for anything that touches your main working copy, your credentials or your production systems. When in doubt, keep the prompts and answer them from the Attention dock.