Blog
Antigravity CLI --dangerously-skip-permissions: same name as Claude Code, different flag
Google gave Antigravity CLI the exact spelling Claude Code users already type. The flag underneath does more than Claude Code's, and that difference is worth thirty seconds before you paste it.
In Antigravity CLI, agy --dangerously-skip-permissions runs every action without asking, the same as the Turbo preset in the app. Unlike Claude Code's flag of the same name, it also sets aside the terminal sandbox and the per-command rules that sit around it, and Google's sandbox setting, enableTerminalSandbox, is off on the CLI by default anyway. Turn the sandbox on, prefer a middle preset, and keep keys out of reach: Forkbench's Vault uses a key without agy ever holding it.
Why the name is misleading
Most agy users arrived from Gemini CLI or Claude Code, and Google reused the flag Claude Code users already know. In Claude Code, --dangerously-skip-permissions removes the approval prompt and nothing else, because Claude Code's reach was never limited by those prompts.
Antigravity's flag sits on top of a permission ladder that includes a sandbox, so skipping permissions there also skips the rungs that were doing the containing. Same spelling, larger effect.
The ladder you are skipping
Antigravity CLI keeps its settings in ~/.gemini/antigravity-cli/settings.json, still under the Gemini folder from before the rename. Terminal permissions run from strict, through request-review, which is the default, and proceed-in-sandbox, to always-proceed. The app shows the same thing as three presets: Default, Request Review and Turbo.
proceed-in-sandbox is the rung worth knowing about. It lets commands run without asking as long as they run inside the terminal sandbox, which is Seatbelt on macOS and kernel namespaces on Linux, with network off by default. That is the unattended mode most people actually want.
Turbo, and the CLI flag, go past it. Google's own documentation of Turbo lists the sandbox as off, and the unsandboxed(...) rules that let you carve out a single trusted command stop meaning anything once everything is unsandboxed.
Two separate switches, and one that is not covered at all
Antigravity splits file edits from terminal commands. agentMode, which takes default, accept-edits and plan, governs whether edits are applied without asking. Terminal permissions are the ladder above. You can approve edits automatically and keep commands on request-review, which removes most of the clicking.
Browser tool permissions are a third list again. Google staff have confirmed on the Antigravity forum that Turbo and always-proceed do not cover them, which is why some users still see prompts with everything else switched off.
Of the CLIs we checked, Antigravity's documentation is the thinnest and occasionally contradicts itself between the codelab, the docs and the changelog, so check /permissions inside a session to see what is actually in force.
How this works in Forkbench
Forkbench is a desktop app for running coding agents, and Antigravity CLI is one of the agents it sets up for you, connecting agy to the Thread's notes and board in one click. It runs the agy you installed, with your settings.json, and it does not stop you passing the flag.
What it adds is the containment the flag set aside. A Thread can be locked to a set of folders by the kernel, applied as each shell starts and inherited by everything agy spawns, so a Turbo session cannot reach past the project. A key in Vault is used by the command that needs it without the value entering agy's environment or its context. And a task agy reports done is a report until a person accepts it, which puts the human at the end of the job instead of in front of every command.
The honest limit: a folder lock bounds files, not network traffic, so the strongest protection for a key is that it was never in the process.
Related: Yolo mode in every coding agent, compared, Antigravity CLI in Forkbench, Claude Code: what --dangerously-skip-permissions actually skips
Frequently asked
Does Antigravity CLI have a yolo mode?
Yes. agy --dangerously-skip-permissions runs every action without asking, matching the Turbo preset in the Antigravity app. In a session, /permissions shows and changes the current level.
Is agy --dangerously-skip-permissions the same as Claude Code's flag?
Same name, different effect. Claude Code's flag removes approval prompts and leaves reach unchanged. Antigravity's also sets aside its terminal sandbox and the per-command rules around it, so it widens what commands can reach, not only who is asked.
Does Antigravity CLI sandbox commands?
It can. enableTerminalSandbox in ~/.gemini/antigravity-cli/settings.json turns on a Seatbelt sandbox on macOS and namespaces on Linux, with network off by default. It is off by default on the CLI, so check it before relying on it.
Why does Antigravity still ask for permission in Turbo mode?
Usually because the prompt comes from the browser tool, which has its own permission list that Turbo does not cover. Google staff have confirmed the split on the Antigravity developer forum.
What should I use instead of --dangerously-skip-permissions in agy?
proceed-in-sandbox, with the terminal sandbox enabled. Commands run without asking as long as they stay inside the sandbox, which gives you unattended work with a wall still in place. Pair it with accept-edits for file changes and most of the prompts are gone.