Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

YOLO Mode

YOLO mode disables every safety gate ZeroClaw ships with. No approval prompts, no workspace boundary, no shell policy, no command allow/denylist, no OTP, no sandbox. The agent can run any shell command, touch any file, hit any URL: immediately, without asking.

This is for dev boxes, home labs, and throwaway VMs. Do not run YOLO mode on shared infrastructure. Do not run YOLO mode on a machine with production credentials in its environment. Do not run YOLO mode if you do not understand what an autonomous agent with rm -rf access can do.

When YOLO is the right call

  • A dev box where you’re iterating fast and approval prompts slow you down
  • A throwaway container/VM used for agent experiments
  • A home-lab SBC where you own every byte on the machine
  • CI/CD pipelines where the agent’s actions are reviewed before merge

When YOLO is the wrong call

  • Your laptop with your email, your browser profile, and SSH keys to production
  • A shared server
  • A VPS with live customers on it
  • Anywhere the agent might be reached by an untrusted user through a channel: a YOLO agent with a public Telegram bot is a Telegram-accessible root shell

Enabling it

Name the YOLO posture explicitly on a dedicated risk profile (yolo is a good intent-naming choice) and point your agent at it. If multiple agents share the host, give the YOLO-bound one its own profile and keep your other agents on a stricter profile (e.g. hardened); risk profiles are per-profile, so a YOLO agent and a hardened agent can coexist in the same config.

What you lose

GuardNormal behaviourYOLO behaviour
AutonomyMedium-risk ops need operator approvalAgent runs everything unattended
Workspace boundaryAgent can only touch ~/.zeroclaw/workspace/Agent can touch any path its user can
Shell policyUnknown commands blockedAny command executes
Forbidden paths/etc, /sys, /boot, ~/.ssh etc. blockedNo path is off-limits
SandboxDocker / Firejail / Landlock / Seatbelt isolates tool executionTools run as the ZeroClaw process user
OTP gatingGated actions require a codeNo gate
Emergency stopzeroclaw estop halts running opsNo halt semantics beyond SIGTERM
Gateway pairingClients must pair firstAnyone who reaches the port owns the agent

What you keep

YOLO mode doesn’t lobotomise the agent:

  • Tool receipts still get written. You can tail -f the receipts log and see exactly what ran.
  • Audit logging still works if enabled ([security.audit] enabled = true). Strongly recommended in YOLO.
  • Conversation memory still persists: there’s still a record of what happened.

You’re not turning off the logs, you’re turning off the approval gates and path enforcement.

Reverting

Delete the YOLO settings from the risk profile, or flip [risk_profiles.<alias>] level = "supervised" back and restart the service. Nothing persists across config changes: each startup loads the current config fresh.

See also