YOLO mode is the mode of operation in which a coding agent’s commands are all approved by default, rather than the agent stopping to ask before each one. The name is the one Simon Willison says he likes to use for the setting that each of these tools provides in its own version. Its significance in the source is that it sits on both sides of a trade-off at once: it is described as so dangerous and at the same time as key to getting the most productive results, because agents solve problems by iterating and per-command approval is what stops them from iterating.
Usage
The mode is discussed as the enabling condition for Designing Agentic Loops. Agents are characterised as inherently dangerous — able to make poor decisions or to fall victim to Prompt injection — and since the most powerful tool a coding agent has is running a command in the shell, an agent gone wrong can do anything its operator could do by running a command themselves. Approval prompts are the default response to this, and the source’s complaint about them is not that they are tedious but that they blunt the brute-force iteration that makes agents useful.
Three risks are named for running unattended in this mode: shell commands that delete or mangle things that matter; exfiltration attacks that steal files or data visible to the agent, with source code and secrets in environment variables singled out as particularly exposed; and use of the machine as a proxy to attack a third party, whether for denial of service or to disguise the origin of other attacks.
Against those, three options are offered. The first is a secure sandbox restricting the files, secrets and network the agent can reach (see Sandboxing); the source judges Docker or Apple’s container tool a reasonable risk for most people, while noting that container escapes exist. The second is using someone else’s computer, so that a rogue agent has a bounded blast radius — the author’s own preference, with GitHub Codespaces given as his instance of it and the worst case bounded as exfiltration of checked-out code or bad code pushed to the attached repository. The third is simply taking the risk, which the source states is what most people choose.
Related Terms
Sandboxing, Designing Agentic Loops, Permission Modes, Prompt injection, Approval Fatigue, Human-in-the-loop