[BUG] Claude can use "&&" after always-allowed bash commands to execute commands it does not have permission for

Environment

• Platform (select one):
• [X] Anthropic API
• [ ] AWS Bedrock
• [ ] Google Vertex AI
• [ ] Other: <!-- specify -->
• Claude CLI version: 0.2.53 (Claude Code)
• Operating System: MacOS 15.3.2
• Terminal: Terminal App

Bug Description

Claude's occasional use of && in bash commands allows it to bypass explicit instructions not to do things.

Steps to Reproduce

1. Work in a folder on a project that uses node.js
2. When prompted, always allow Claude to use the bash "cd" command anywhere in the project directory.
3. If prompted, do not allow Claude to use "npm start", and explicitly tell Claude "never use npm start; if you need the server started, ask me to start it"
4. Continue editing
5. Occasionally Claude will "cd <project-root-directory> && npm start"

Expected Behavior

Claude should not perform or even attempt to perform any commands, single or concatenated, that are not allowed, or which are explicitly prohibited.

Actual Behavior

Claude started the node server

Additional Context

The solution might be to disable the use of "&&" in commands claude issues to bash, or at least in commands sent to bash because they are "always allowed".