[BUG] Background agents cannot run Bash commands - auto-denied without prompting user

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When using the Task tool with run_in_background: true, Bash commands are auto-denied with "prompts unavailable" error. I expected to be prompted for permission, but I never receive any prompt - the commands are silently denied.

What Should Happen?

Is it possible to run Bash commands that require approval from background agents? If so, how do I grant permissions?

Error Messages/Logs

Steps to Reproduce

Environment

• Claude Code Version: 2.1.7
• Platform: Linux 6.8.0-90-generic (Ubuntu)
• Date: 2026-01-14

What I'm Trying To Do

Run the OpenAI Codex CLI (codex) from a background agent so I can continue working while the command executes.

Steps to Reproduce

1. User prompts Claude Code:

> "Run this command in a background agent: codex exec -m gpt-5.2 --sandbox read-only 'Say hi'"

1. What Claude Code does behind the scenes:

• Launches a background agent using the Task tool with run_in_background: true
• The background agent attempts to run the command via the Bash tool

1. What happens:

• Claude Code's Bash tool auto-denies the command - it never executes
• I never get prompted for approval - it's silently denied

Test Results

I prompted Claude Code to run this simple command via a background agent:

codex exec -m gpt-5.2 -c model_reasoning_effort="low" --sandbox read-only --skip-git-repo-check "Say 'hi, we are testing this tool'"

Claude Code launched the background agent, which returned:

"It appears that Bash execution permission was auto-denied. This command requires running an external CLI tool (codex) which needs Bash execution access."

The agent even tried to ask for confirmation but couldn't because background agents can't prompt the user.

Same command from main context: When I ask Claude Code to run the command directly (not via background agent), it works - I get prompted and can approve.

Observations

I tested various commands via background agents:

| Command | Result |
|---------|--------|
| ls -la | ✅ Works |
| date | ✅ Works |
| whoami | ✅ Works |
| echo "hello" | ✅ Works |
| python3 --version | ✅ Works |
| curl --version | ❌ Auto-denied |
| npm --version | ❌ Auto-denied |
| codex exec ... | ❌ Auto-denied |

Conclusion:

• Commands considered "safe" are auto-approved and work fine
• Commands that would normally require user approval are auto-denied
• No prompt is ever shown - it's silently denied
• This is NOT specific to codex - affects curl, npm, and likely other CLI tools

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.7

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Xterm

Additional Information

Questions

1. Is this expected behavior? Are background agents intentionally unable to prompt for Bash approval?

1. Is there a way to pre-approve commands for background agents?

1. Can background agents inherit permissions from the parent session?

1. What's the recommended pattern for running CLI tools in the background?

Workaround

Run the command from main context, which blocks the session while waiting.