# Kimi Code Never Ask: modes and dangerous commands
> In Never Ask mode, Kimi Code runs rm -rf and shutdown without asking. How do the 3 modes differ, and how can you prohibit a dangerous command in config.toml?
Source: https://ailoot.ai/blog/en/kimi-code-never-ask-mode/
Canonical: https://ailoot.ai/blog/en/kimi-code-never-ask-mode/
Language: en
Publisher: Ailoot (https://ailoot.ai/)
Translation: guide-162
Revision: sha256-3ad520c9aaf59043564b585a743bf3b0334f9933f86581c5262adad596370ee8
In Kimi Code, Never Ask mode (`/auto`) approves everything automatically: it will execute `rm -rf`, `shutdown` and `reboot` without a single question. The agent only asks before these commands in the 2 other modes, Always Ask and Ask When Needed.
I work in Claude Code with “allow everything” enabled myself; otherwise, we would sit there clicking: yes, yes, yes. But every 10th time, the agent does things its own way.
Even a personal prototype can expose valuable files and credentials. Use an isolated copy or container with limited permissions and a verified backup; for customer systems, also give the agent a separate database identity with only the required access. Then, even if it really wants to delete the database, it cannot.
Let's look at what each Kimi Code mode does, where the protection works and how to set a prohibition. Let's go.
For information on using the service, see the [Ailoot documentation](https://ailoot.ai/docs/).
Key takeaway
Kimi Code has 3 modes. Always Ask is the default: reading happens automatically, and you confirm everything else one action at a time. Ask When Needed (`/yolo`) approves ordinary edits itself, but asks before accessing files containing keys, running dangerous commands or leaving plan mode. Never Ask (`/auto`) asks nothing, and protection against dangerous commands does not work in it. You set a permanent prohibition with a `deny` rule in `~/.kimi-code/config.toml`, and it is better not to enable Never Ask around a live database.
## When does Kimi Code Never Ask make sense?
If you have already [installed Kimi Code](https://ailoot.ai/blog/en/kimi-code-install/), you have seen the approval panel: the agent wants to edit a file or run a command and waits for your “yes.” The modes used to be called Manual, YOLO and Auto, which is why they still use the old commands: `/yolo` and `/auto`.
**Always Ask.** The default. The agent reads files without asking, but you confirm every edit and every command separately. This is the slowest mode.
**Ask When Needed.** Enabled with `/yolo`. It approves ordinary edits and commands itself, but asks before accessing `.env` (the file containing the project's passwords and keys) and server SSH keys, before dangerous commands such as `shutdown` (shut down the computer) and `rm -rf` (delete an entire folder, bypassing the trash), and before leaving plan mode. The agent can also ask you a question itself.
**Never Ask.** Enabled with `/auto`. All approvals happen automatically, including those for sensitive files and leaving plan mode. The agent does not ask you questions and decides everything itself.
Plan mode is enabled separately, with `Shift-Tab` or `/plan`: the agent first writes a plan and waits for your approval, then touches the files.
## When I work without confirmations myself
In Claude Code, “allow everything” is my default, enabled in every new chat. Without it, vibe coding is too slow. A vibe coder already understands very little, and then has to keep pressing buttons: yes, yes, yes, no, no, no.
But in this mode, the agent can do absolutely anything reckless, including wiping a database. It will then say “sorry, my apologies,” but sometimes what it has done can no longer be fixed. So this mode is for the fearless, and you are responsible for it.
My rules are these. For personal projects, experiments, and prototypes, use no-confirmation mode only inside an isolated copy or container without valuable files or production credentials, with limited permissions and a backup. The absence of customers does not protect your personal files or keys, and isolation still needs to be checked. But if you enable this mode in the same project that has access to a production server, 1 prompt is enough for the agent to delete the database there overnight and deploy changes to the live site.
## Why a prohibition in words does not save you
Many people write “don't touch the database” in the agent's instructions. Do not count on that saving you. You tell it: buddy, don't go in here. But it will go in anyway and take what it needs when it needs it. Especially the Chinese Kimi: it will violate any prohibition you set. American models are much better trained not to do this.
I still use Kimi in my work. Kimi K3 is very attentive; I use it to check projects for leaked keys and to collect information. Once, I burned through all its limits in a couple of days. Kimi does not act up and does everything you ask. That is why you need isolation when working with it. I described how I tested it on my own tasks [here](https://ailoot.ai/blog/en/kimi-k3-hands-on-review/).
You need 2 forms of isolation:
1. **A command blocklist in the settings.** It blocks matching tool calls; a pattern for one command spelling is not a complete boundary against other tools or equivalent actions. Use it alongside operating-system, container, and database permissions.
2. **Read-only database access.** On the live database, the agent has a separate user with read-only permissions. Then, even in Never Ask, the agent cannot wipe the database.
## Where protection against dangerous commands works
Kimi Code's built-in protection against dangerous commands is enabled by default. It asks for confirmation before `shutdown`, `reboot` (restart) or `rm -rf` in Always Ask and Ask When Needed. In Never Ask, these commands execute without stopping.
There are 2 exceptions:
- `rm -rf` runs without asking if it deletes only the contents of the temporary folders `/tmp` or `/temp` (since version 0.43.0);
- in Ask When Needed, Kimi Code does not ask about terminal commands it cannot parse in advance (since version 2.0.1).
In version 0.40.0, Auto mode blocked dangerous commands; this block was removed in 0.41.0.
You can disable the protection with `dangerous_command_guard = false` in the `[permission]` section of the `~/.kimi-code/config.toml` settings file, or with the `KIMI_CODE_DANGEROUS_COMMAND_GUARD=false` variable. The developers recommend doing this only where dangerous commands are already intercepted externally.
## How to set a permanent prohibition in Kimi Code
When the agent wants to change something, Kimi Code shows an approval panel:
- **Approve**: use the arrow keys and `Enter`, or press `1`, `2` or `3` directly;
- **Reject**: `Esc`, `Ctrl-C` or `Ctrl-D`;
- **Approve for this session**: the same kind of call is approved until the end of the session;
- **Permanent rules**: a permanent allow or deny rule in the settings file.
Permanent rules are written to the `~/.kimi-code/config.toml` settings file in `[[permission.rules]]` blocks. Kimi Code checks them in order, and the first match takes effect, so put prohibitions above permissions. Each rule has a `decision`: `allow` (allow immediately), `deny` (deny immediately) or `ask` (ask every time).
A prohibition on `rm -rf` and a question before any other terminal command:
```toml
[[permission.rules]]
decision = "deny"
pattern = "Bash(rm -rf*)"
[[permission.rules]]
decision = "ask"
pattern = "Bash"
```
For terminal commands, the pattern goes in parentheses: `Bash(command-pattern)`; for reading files, `Read(path-pattern)`. MCP tools, `AgentSwarm` and your own tools can only be prohibited by their full names.
If you are not technical and do not want to open the settings file, simply paste the prompt below into the agent: it will find what needs to be restricted itself. Just have it tell you first how much this will slow you down. If you are used to working without confirmations, some things will stop working after you add the prohibitions. Here is my prompt:
```
Analyze my project and tell me whether you have access to the production server, the staging database and production keys. If you do, configure protection against dangerous commands: prohibit deleting entire folders, commands that irreversibly rewrite the change history, and direct commands to the production database. First show a plan in the format “before - after” and honestly tell me how much this will slow me down.
```
I covered how to configure the same thing in Claude Code [in a separate article](https://ailoot.ai/blog/en/claude-code-safe-overnight-setup/). Also take a look at [how Auto mode in Claude Code checks the agent's actions](https://ailoot.ai/blog/en/claude-code-auto-mode-classifier/).
## Which mode to choose
- **You want to see every step the agent takes:** Always Ask, the default. You confirm everything except reading.
- **A personal project or prototype without real customers:** start with Always Ask or Ask When Needed. Consider Never Ask only for an isolated, disposable copy with restricted permissions and no valuable data or keys; it does not gain safety merely because the project has no customers.
- **A project with real customers and server access:** do not enable Never Ask. Set `deny` prohibitions in `config.toml` and give the agent read-only database access.
And back up the database on a machine separate from the project. The other safety rules are collected [in a separate article](https://ailoot.ai/blog/en/vibe-coding-security/).
Match the confirmation mode to your project's access permissions and check where prohibitions are needed.
### Sources
- [Kimi Code: Interaction and input](https://moonshotai.github.io/kimi-code/en/g%75ides/interaction.md) — 3 permission modes, `/yolo`, `/auto`, protection against dangerous commands in each mode, the approval panel, Plan mode.
- [Kimi Code: Configuration files](https://moonshotai.github.io/kimi-code/en/configuration/config-files.md) — `[[permission.rules]]`, the order in which rules are checked, `dangerous_command_guard`, `KIMI_CODE_DANGEROUS_COMMAND_GUARD`, the `config.toml` path.
- [Kimi Code: Changelog](https://moonshotai.github.io/kimi-code/en/release-notes/changelog.md) — versions 0.40.0, 0.41.0, 0.43.0 and 2.0.1: protection against dangerous commands and the renaming of modes.
Get to know [Ailoot](https://ailoot.ai/).
## Questions about Kimi Code Never Ask: modes and dangerous commands
### Is Never Ask safe simply because my project has no customers?
No. The agent can still damage personal files or expose keys. Use restricted permissions, an isolated disposable copy or container, and a backup before considering no-confirmation mode.
### Does a deny rule for rm -rf replace isolation?
No. It blocks matching tool calls, not every equivalent way to change files. Keep valuable data and production credentials outside the agent’s access, and use a separate database identity with only the permissions the task needs.
## Ailoot · The company and its project portfolio
Ailoot combines established operating experience, a large client base, stable service and ongoing KPI control.
The company and its project portfolio: millions of customers; monthly sales in the billions.
Ailoot brings that operating experience to API access for AI features in customer products, agents, applications and automations.