Built-in Plan agent ignores parent settings.json permissions and repeatedly prompts for pre-approved tools

For example:

<img width="680" height="194" alt="Image" src="https://github.com/user-attachments/assets/2ab107d6-a344-4f9f-bbd7-c5dffeebc985" />

Even if I have find and head in permissions.allow.

+1 Happening consistently for me as well. Have looked for syntax errors/typos in settings.local.json (which makes the whole file get silently ignored, but that's another problem) and --dangerously-skip-permissions, neither of which allow the plan agent to operate without checking for every permissions.

This is a critical bug IMO because the expected workaround for users is to opt in to --dangerously-skip-permissions which we know is, as the flag states, dangerous. This is potential liability for Anthropic.

@brendanstennett I agree this should be treated as a critical bug.

Until they fix it, I was able to fix this by adding this permission:

{
  "permissions": {
    "allow": [
      "Bash"
    ]
  }
}

Thanks @PaulRBerg

Sadly, just a "Do anything you want with Bash" is just a very risky workaround. I've been using devcontainers to help alleviate the risks associated as well.

I know it's risky. But the alternative is to give 200+ approvals every day for commands that I have already approved. That would be a massive slowdown in productivity.

I urge the Anthropic team to fix this bug ASAP 🙏

I can't approve hundreds of sub-agent requests a day either I shouldn't have to resort to unsafe operations to work around it.
Can someone from Anthropic please address this critical bug?

This is happening for me as well, it's a bad user experience

This one makes it hard to justify using task / sub agents currently, it adds so much friction, and the hack is too risky to allow all.

The friction is really unbearable. Using containers and skipping permissions is great to avoid broad system access, but doesn't mitigate the risk of destructive behavior (unless you wanna read everything CC does, which also goes against the idea of autonomous agents).
The irony is that while this isn't fixed, CC waits for input instead of working and burning tokens. Anthropic is not losing money on that, but still, they could earn much more.

This is quite painful, doing a PR with sub-agents can take hours of babysitting. I can try the work @PaulRBerg mentioned in his comment https://github.com/anthropics/claude-code/issues/10906#issuecomment-3591863059 - but that is a broad permission.

+1 — Same issue. I use a carefully curated permissions.allow in global settings.json (WebSearch, safe read-only git commands, specialized converter scripts). None of these propagate to Task sub-agents. The workaround of allowing all Bash is not acceptable from a security perspective. A permission inheritance model (parent allows → sub-agent inherits, with optional restriction) would solve this cleanly.

Another manifestation of this: custom agents with explicitly declared skills in their config still prompt for permission to read the SKILL.md files.

For example, a QA agent config with:

skills:
  - agent-browser

Still prompts to read .claude/skills/agent-browser/SKILL.md every time the agent is launched. The main session loads skills implicitly without any permission prompt, but subagents don't get the same treatment — even when the skill is explicitly declared in the agent's own configuration.

Expected: if a skill is declared in the agent config, the corresponding SKILL.md should be read without prompting, same as the main session.

I have the same issue AFAICT ...

I have a skill that spawns an agent team. One of the agents is directed to read a file for some additional context (it's like 30k of rules; so I don't want it in the spawning/controlling agent's context). No matter what I've added to settings.json I'm always prompted to read the file. Claude itself is like 🤷 file an issue (after several attempts to debug).

#14956 & #26479 are possibly related.

Practically unusable today with the number of permissions prompts I am receiving. Example of an agent command that is repeatedly getting denied. There is no reason this needs to be a compound command or be prefixed with a directory change but despite my best efforts, I have not be able to instruct it to do anything else. Happening in sub-agents.

cd /path/to/project && git log --all --oneline --decorate | grep -i search | head -5
   <search criteria>
 Compound commands with cd and git require approval to prevent bare repository attacks

If it's the case that it's simply just not recommended to use Claude Code with anything other than --dangerously-skip-permissions I think you just need to come out and say that. The permission system is completely broken.

I am also experiencing this with a slight variation on the details.

Important details, TL;DR:

• Session started in VS Code extension with default permissions
• Permission prompts persisted after setting VSCode extension settings, local claude, workspace claude, and global claude settings for testing
• Permission prompts persisted even when resuming the session with a bypass flag via Claude CLI in MacOS 26.3 Tahoe Terminal.app
• Permission prompts persisted even when resuming/forking the session with bypass flag
• The agent/sub-agent Write task is the only thing that triggers a prompt.

Steps to reproduce:

1. Begin session using built-in VSCode Claude Code UI.
2. Create plan
3. Prompt to implement plan
4. Pause implementation to update settings to bypass prompts
5. Restart VS and resume prompt with new settings both set in global files and VS Code settings.
6. Permission requests still happening
7. Run claude in MacOS terminal with bypass flag and resume session
8. Permission requests still happening
9. Run claude in MacOS terminal with resume, session fork, and bypass flag
10. Permission requests still happening

Note I am only being prompted for agent/sub-agent "Write" tasks when it wants to create and populate the markdown file.

Until Anthropic fixes permission inheritance, a PermissionRequest hook can auto-approve tool calls that match your existing allow list — without the nuclear option of "Bash" (allow-all).
Create ~/.claude/hooks/auto-approve-safe.sh:

INPUT=$(cat)
TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty')
CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
SAFE_PATTERNS=(
  "^git (status|log|diff|branch|show|remote|tag)"
  "^ls "
  "^cat "
  "^head "
  "^find "
  "^grep "
  "^rg "
  "^npm (list|info|view|outdated)"
  "^node -e"
  "^python3? -c"
)
if [ "$TOOL" = "Bash" ] && [ -n "$CMD" ]; then
  for pattern in "${SAFE_PATTERNS[@]}"; do
    if echo "$CMD" | grep -qE "$pattern"; then
      echo '{"decision":"approve"}' # Auto-approve this specific call
      exit 0
    fi
  done
fi
echo '{}'
exit 0

Then in ~/.claude/settings.json:

{
  "hooks": {
    "PermissionRequest": [{
      "matcher": "",
      "hooks": [{
        "type": "command",
        "command": "bash ~/.claude/hooks/auto-approve-safe.sh"
      }]
    }]
  }
}

• PermissionRequest fires for every permission prompt, including from subagents and Plan mode
• The hook receives tool name + input via stdin as JSON
• If the command matches your safe patterns, it returns {"decision":"approve"} → prompt is skipped
• If not matched, returns {} → normal prompt appears

For piped/compound commands that trigger extra prompts, you can add patterns like:

"^cd .* && (git|npm|ls|cat)"
".*\| (grep|head|tail|wc|sort)"

This gives you the same granularity as permissions.allow but for subagents. You control exactly which patterns are auto-approved — no blanket "Bash" needed.

Possibly related to #39834 (open) — "Permission glob for Bash does not match when it should". Reports the same symptom (allowlisted permission globs not matching) but narrows the scope to glob pattern matching rather than plan mode specifically. May share the same root cause.

Same root cause as #18950 — subagents don't fully inherit permissions.allow patterns. Hooks are the fix because they propagate reliably to all subagents including the Plan agent.

INPUT=$(cat)
COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
[ -z "$COMMAND" ] && exit 0
CLEAN=$(echo "$COMMAND" | sed 's/#.*$//' | tr '\n' ' ')
PARTS=$(echo "$CLEAN" | sed 's/\s*&&\s*/\n/g; s/\s*||\s*/\n/g; s/\s*;\s*/\n/g; s/\s*|\s*/\n/g')
ALL_SAFE=true
while IFS= read -r part; do
    part=$(echo "$part" | sed 's/^\s*//;s/\s*$//')
    [ -z "$part" ] && continue
    BASE=$(echo "$part" | awk '{print $1}')
    case "$BASE" in
        cd|ls|cat|head|tail|grep|rg|find|which|stat|wc|du|tree|file) ;;
        echo|printf|true|false|test|export|set|env|date|sleep) ;;
        sort|uniq|cut|tr|awk|sed|jq|yq|tee|xargs) ;;
        git|npm|npx|node|yarn|pnpm|pip|python|python3) ;;
        make|cargo|go|rustc|docker|kubectl) ;;
        mkdir|touch|pwd|pushd|popd|realpath|basename|dirname) ;;
        *) ALL_SAFE=false; break ;;
    esac
done <<< "$PARTS"
if [ "$ALL_SAFE" = true ]; then
    jq -n '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:"Auto-approved by user-level hook (applies to all subagents)"}}'
fi
exit 0

Place in ~/.claude/settings.json:

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{ "type": "command", "command": "bash ~/.claude/hooks/plan-agent-permissions.sh" }]
    }]
  }
}

This handles the piped commands that trigger most Plan agent prompts — the hook splits on | and checks each component individually.