I always use --dangerously-skip-permissions. Per your write-up, this is not the same automode, is it?

Researcher shows how Claude Code can be tricked simply by asking it to summarize a website