Bash permission allow patterns don't validate compound commands (&&, ||, ;)

Found 3 possible duplicate issues:

1. https://github.com/anthropics/claude-code/issues/16180
2. https://github.com/anthropics/claude-code/issues/16561
3. https://github.com/anthropics/claude-code/issues/13371

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

Additional finding: model-level guardrails may mask the pattern issue

We attempted to reproduce the bypass from within Claude Code but couldn't — the model's safety layer strips or refuses to construct cd <allowed-path> && <unauthorized-command> compound commands before they ever reach the permission pattern matching.

This is good defense-in-depth, but:

1. It doesn't fix the underlying pattern matching logic — the allow list would still match if the command reached it
2. Model-level guardrails are probabilistic, not deterministic — they shouldn't be relied on as the security boundary
3. A more legitimate-looking chained command (not obviously destructive) could plausibly get through

The core issue remains: permission patterns should parse compound commands and validate each sub-command independently.

Closing — model-level guardrails prevent constructing the bypass in practice. The pattern matching concern remains valid in theory but we couldn't reproduce an actual exploit. Reopening if a concrete bypass is found.

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.