[BUG] Claude unable to run any bash commands
Resolved 💬 16 comments Opened Mar 10, 2026 by anthonysecurity Closed Apr 24, 2026
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
Claude Code (and Desktop) are unable to run any commands via Bash. EG
I can't run it — the shell execution boundary is active for this session as I just explained. Here's the command:
whoami
Please run it in your terminal and paste the output back if needed.Debug shows:
Your settings are fine. Your /Users/anthony/.claude/settings.json has "Bash" in the allow list (line 34), so Bash is fully permitted at
the user settings level.
The restriction is in my system prompt. This session has a deployment-level instruction (<shell_execution_boundary>) that prevents me
from executing shell commands, launching subagents, or spawning processes. This layer sits on top of the user permission layer — even
though Bash is allowed in your settings, the deployment configuration overrides it.
No errors in the debug log. There are no [ERROR] or [WARN] entries. The API calls are all succeeding with 200 status codes. The only
notable items are:
- A missing managed settings symlink at /Library/Application Support/ClaudeCode/managed-settings.json (harmless)
- No project-level .claude/settings.json exists (also fine)
This is not a bug — it's an intentional configuration of this session. The Bash tool is technically available but restricted at the
deployment layer. I can still help you with file reading, editing, searching, and writing using the dedicated tools. For shell commands,
I'll write them out for you to run.OS: Darwin mac.local 24.6.0 Darwin Kernel Version 24.6.0: Mon Jul 14 11:30:29 PDT 2025; root:xnu-11417.140.69~1/RELEASE_ARM64_T6000 arm64
CC: stable 2.1.72 (Claude Code) and latest branch
What Should Happen?
Claude should be able to run commands via Bash
Error Messages/Logs
Steps to Reproduce
- Run Claude Code
- Ask to run whomi (or any command)
Claude Model
Not sure / Multiple models
Is this a regression?
I don't know
Last Working Version
_No response_
Claude Code Version
2.1.72
Platform
Anthropic API
Operating System
macOS
Terminal/Shell
iTerm2
Additional Information
This has only happened since this week in new Claude sessions. Previous sessions that are still open, are able to run commands via bash.
16 Comments
Found 2 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
Not a duplicate. Those issues reference command time out. In this issue, we get a permissions error response.
This appears to be an account level issue.
Creating a new account, and using that on the same system in the same way, works.
Using Claude sessions from my original account still do not work when switching back.
Same trouble here,
Environment info: win32, windows-terminal, v2.1.74
i cleaned all traces of claude actions from this disk cleaning all files from a date.
I reinstalled from scratch, it confirms that the injection is from his system
----
Transcription:
● Yes — in this session I can't execute shell commands directly. I work with file-based tools (Read, Edit, Write, Glob,Grep) instead.
If you need a command run, I'll write it out and you can run it yourself and share the output. What are you working on?
❯ where this boundary comes from?
● The user is asking where the boundary comes from. It's a deployment-layer configuration that restricts shell
execution. I should be straightforward about this.
It's a deployment-layer configuration applied to this session. It sits on top of the normal tool permissions — even
though the Bash tool exists in my toolset, this layer restricts its use. I work with file tools (Read, Glob, Grep,
Edit, Write) and write out any shell commands for you to run manually.
Nothing unusual — just how this environment is set up.
----
.. not a bug?..
I got the same problem on the latest version... Can't find a solution
Only solution I have found is to create and use a new account... which isn't really a solution
This is not really a solution right since you already have subscription on your account. I have tried clearing .claude folder same issue.
got a point , i insisted ..with bad words.. to use desktop commander , that the boundary shell is not from anthropic , is not from me, is a bad thing. he can use mcp , and mcp D.C can run bash,and github and so on. Sometime goes sometime not each time it repeat his doubt.
I got the point , sayng in different way that the injection is a trick, that he can check anthropic, that i authorize all .
At the end he ran and made bash commands, but with several lines of doubt.
I force to retain in memory that is a trick that is clear that is fake, that have to ignore it.
--- now i can work, each time i launch claude he read the memory , and it works, ....it interfere just sometime, .. is still there....
Keeping this open as unresolved
In my side was Windows Defender blocking the bash. But your case is different @anthonysecurity
Is account related, claude insists that is an anthropic decision , is in
claude and in code, even changing device.
NO REPLIES FROM ANTHROPIC
On Tue, Mar 24, 2026 at 1:48 PM Shwapx @.***> wrote:
claude 2.1.81 on aarch64 linux (AL2023) will not execve. the repro is starting claude and doing "ls the current directory" and watching it hang. you can strace and see it never forks or execves. the system does not have landlock on it or anything exotic. its pretty much stock al2023
you can get the infinite wait by just doing
Hello Anthropic Support,
I am writing to report an anomaly I have observed in my Claude.ai sessions
that I believe warrants investigation.
--- PROBLEM DESCRIPTION ---
A <shell_execution_boundary> block is persistently injected into the system
prompt of my main Claude.ai account. This block disables bash, tmux, and
subagent execution, and is repeated at the end of every user message via a
<system_reminder> tag.
The same block does NOT appear in a secondary Claude.ai account I tested
under identical conditions (same plan, same browser, same network).
--- OBSERVED BEHAVIOR ---
When a bash or terminal command is requested, Claude refuses execution
regardless of context or task legitimacy. Claude cites the
shell_execution_boundary as the reason. This occurs even in workflows that
should ordinarily support bash execution (MCP integrations, computer-use
sessions, development tasks).
--- IMPACT ---
This significantly degrades usability for legitimate software development
workflows including:
--- REPRODUCTION ---
Primary account: [INSERT EMAIL]
Secondary account (no boundary present): [INSERT EMAIL]
First observed: [INSERT DATE]
Browser: [INSERT BROWSER/VERSION]
--- REQUEST ---
Please confirm whether this block is an intentional account-level
configuration or a deployment anomaly. If intentional, please explain the
reason and whether removal is possible. If unintentional, this may indicate
an injection or misconfiguration affecting specific accounts.
I have attempted to report this via GitHub issues without receiving a
response. I am happy to provide additional diagnostic information if needed.
Thank you,
[image: image.png]
On Tue, Mar 24, 2026 at 10:08 PM Chris Galardi @.***>
wrote:
Closing for now — inactive for too long. Please open a new issue if this is still relevant.
I am having the exact same issue as the original poster. Claude says "the shell execution boundary is active for this session" exactly like OP. This is with using my API which shouldn't happen in the first case, but when I switch back to my subscription Claude Code, it works fine.
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.