Bash execution issues on Linux
Issues the maintainers labelled both platform:linux and area:bash.
197 issues · 43 open · 154 resolved (78%) · first seen Jan 3, 2026
Is this getting better or worse?
This class of problem is converging. 70 new reports in the last 90 days vs 116 in the 90 before — -40%. The open backlog peaked at 43 in 2026-08 and sits at 43 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
151 of these reports name the Claude Code build they were running, spanning 86 releases. Heaviest reporters:
- Claude Code v2.1.233
- Claude Code v2.1.205
- Claude Code v2.1.150
- Claude Code v2.1.158
- Claude Code v2.1.156
- Claude Code v2.1.112
- Claude Code v2.1.68
- Claude Code v2.1.74
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 32 days across 154 closures. Of the 154 closures with a recorded reason, 27% were closed as completed and 112 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
76 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] Bash comments break permissions
- Workaround: a PreToolUse hook can strip the comment lines before permission matching sees them. The hook reads the command, removes leading lines, and returns the clean command via . Your allowlist then matches correctly…
Found in the thread of #29582 · resolved - Background process termination crashes Claude Code in Docker containers
- …al to kill the process group (e.g., ), it kills itself too. Workaround Manually using to isolate background processes works: However, this loses Claude's background process monitoring and notification features. Suggested…
Found in the description of #16135 · still open - Bash(command:*) allow rules do not prevent permission prompts for file-modifying commands
- …in the desktop app ( , then ), and there's no config or UI workaround. Considering reopening this or filing a new issue — happy to do whichever the maintainers prefer.
Found in the thread of #20449 · resolved - [Bug] Agent spams no-op echo probe commands to flush shell output
- …h a real completion signal — never a burst of no-op echoes. Workaround in use: Added an explicit "never fire no-op probe commands" rule to global CLAUDE.md, but the model should not need this instruction — the default be…
Found in the description of #63887 · still open - [Bug] v2.1.117 regression: parallel Bash tool calls corrupt fd 3 in nested-Docker sandbox; permanent /proc/self/fd/3: Permission denied
- …, or timing. Filing what I've reproduced deterministically. Workaround Possibly related - 2.1.113 introduced the switch from "bundled JS" to "native Claude Code binary" per its release notes. The native binary's sandbox…
Found in the description of #51837 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–100
Ranked by community engagement (reactions weighted over comments).
- [BUG] Bash comments break permissions
- Background process termination crashes Claude Code in Docker containers
- Bash(command:*) allow rules do not prevent permission prompts for file-modifying commands
- [Bug] Agent spams no-op echo probe commands to flush shell output
- [Bug] v2.1.117 regression: parallel Bash tool calls corrupt fd 3 in nested-Docker sandbox; permanent /proc/self/fd/3: Permission denied
- Security heuristics override explicit permission allowlist
- Bash tool returns exit code 127 on every command in 2.1.147
- Bash allowlist pattern 'Bash(curl *)' in settings.local.json not matching — repeated permission prompts
- Doing useless tool call wasting token
- [BUG] Command parsing for permissions incorrectly handles # even when properly commented
- [BUG] Bash permission pattern breaks when command contains parentheses
- Shell snapshots base64-encode function bodies, making obfuscated content indistinguishable from a malicious payload
- bypass permissions mode steers agents off Read/Edit/Grep onto composed shell strings, reintroducing quoting and exit-code failures that the structured tools cannot have
- [BUG] Repeated Bash tool-call loop during git workflow consumed session limit
- Bash/Read tool results intermittently return empty (then flush late, redundantly) on Linux — NOT length/concurrency-correlated; same symptom as stale-closed #36038
- [BUG] Bash tool: exit 126 with "permission denied: /proc/self/fd/3" on Fedora 43 + zsh, blocks git writes, `ls -la`, `gh`
- Bash tool does not inherit PATH from launching shell environment
- Bash permission glob matching breaks when command contains # character
- grep shell shim (claude-as-ugrep): unbounded memory growth on ERE bounded quantifiers {m,n} — OOMs the host
- [BUG] Bash and Read tool outputs arriving one turn late
- Bash sandbox (bubblewrap) corrupts `!` to `\!` in commands, making the sandbox unusable for agentic workflows
- Temp-filesystem preflight false-positives ENOSPC on filesystems with >17.6 TB free (statfs 32-bit truncation)
- [BUG] sandbox auto-allow does not work vor env-prefixed commands
- [BUG] Not honoring SHELL variable when bash is not installed
- Bash tool returns exit code 1 with no stdout/stderr on CachyOS (Arch Linux)
- [BUG] Auto-mode safety classifier reports model "temporarily unavailable," blocking all Bash/WebSearch while normal generation works fine
- [BUG] Bash tool stdout containing data:image URLs is intercepted as image block, causing unrecoverable API 400 "Could not process image" session corruption
- Worker fork / subagent is not woken by the completion of its LAST pending background task
- [BUG] Claude Code's Bash execution waits forever with no processes running
- Bash tool silently returns empty output when `/tmp/claude-$UID/` exceeds tmpfs quota
- Background task respawns infinitely when command hangs, causing fork bomb
- [BUG] Pipes silently broken in sandbox: shell-quoted "<" in oAD passes literal argument to eval instead of redirect
- Bash read-only commands (curl, gh) still prompt for permission despite allow rules
- [BUG] Shell snapshot captures mise functions without `__MISE_EXE` variable, causing infinite fork recursion and OOM
- [BUG] Bash tool timeout kills Claude Code process (SIGTERM propagation), not just the child command
- [BUG] Permission parser treats # in multi-line quoted strings as shell comments
- Background Bash processes can run indefinitely with no visibility to user or model
- [BUG] v2.1.105 shell snapshot contains 'set -o onecmd', causing all Bash tool calls to produce no output
- Bash tool: shell-quote mangles { }, heredoc markers, and $ in piped commands
- Bash tool timeout not enforced on piped commands
- [BUG] Opus deleted entire repository without realizing it (corrupt tool call?)
- [Bug] grep shell wrapper silently overrides -E (ERE) with -G (BRE) via ugrep — breaks scripts using extended regex
- [BUG] Bare prompt 'changelog' can trigger recursive 'claude changelog' self-invocation, spawning hundreds of sessions and exhausting quota
- Claude Code sets VIRTUAL_ENV='' which breaks pixi-managed pre-commit hooks
- Shell snapshot $PATH not expanding — commands not found in Bash tool
- [Bug] Claude Code freezes during execution
- Shell becomes unusable when CWD is deleted (e.g. after git worktree remove)
- Bash-tool `grep` shim (ugrep emulation): catastrophic backtracking — 6.6 GB RSS / OOM kill on a 20 KB file
- [BUG] Embedded ugrep OOMs on bounded-repeat regex while Bash grep is silently shadowed (Linux, 2.1.205-2.1.212)
- Background tasks mass-killed by memory-pressure reaper on Linux hosts with low MemFree but high MemAvailable (PSI ~0)
- [BUG] Asked permission to run `cd /x/y/z && rm -rf *` in "bypass permissions" mode.
- [BUG] Claude reports negative free space on large disks, due to integer overflow
- PreToolUse hook `if` filter false-positives on complex Bash commands
- [BUG] Claude code web Setup scripts: a failed script is recorded as success, its env exports don't reach agent shells, and its output is never logged
- [BUG] Bash tool hangs and executes as background tasks in VSCode Copilot harness
- [BUG] Heredoc as first argument bypasses pipe target permission checks
- [BUG] Bash tool fails silently when /tmp is full
- [BUG] Sandbox suggestion from the docs breaks Bash's working dir
- [BUG] aarch64 linux (al2023) bash tool process spawning completely broken
- [Bug] Session appears stuck when bash command disrupts network connectivity
- [BUG] Claude runs vitest in Node v18 but I installed v22 in my PC
- [BUG] [WORKAROUND] Shell snapshot duplicates -- separator when serializing alias with dash name
- [BUG] Allow bash commands with environment variables
- [BUG] Freezes terminal most of the time when trying to access anything remotely related to tty devices
- [Opus 4.6] Claude Code deleted all personal files with find / -delete during security test execution
- Subagent Bash tool calls are never executed; run ends with terminal_reason "tool_deferred" while reporting success
- [BUG] Shell snapshot leaking definitions into stdout
- [BUG] Model emits fish-syntax to Bash tool when login shell is fish
- [Bug] Intermittent Bash command failures with exit code 1
- [BUG] `normalizeToolInput` strips `cd <cwd> &&` from Bash commands before PreToolUse hooks can inspect them
- Shell snapshot uses unguarded $ZSH_VERSION, breaks set -u (nounset)
- [BUG] Bash tool dispatch with sandbox stalls 8-16s between permission decision and shell spawn; UI frozen during stall
- [Bug] Working directory not reset between bash command executions
- Bash-tool snapshot-source wrappers accumulate during subagent dispatch, triggering process-cascade OOM
- [BUG] Unbounded memory usage in LXD VMs where tool calling is used (CLI + VSCode Extension)
- Terminal becomes unresponsive when running grep on external SSD
- [BUG] Title: Bash tool: third-party CLI binaries silently fail (exit 1, no output) even with dangerouslyDisableSandbox: true
- [BUG] `Bash(git diff)` truncating hunks
- [MODEL] Sonnet 4.5 Generates bash non Claude format wildcard glob patterns into settings.json
- Shell variable expansion broken in piped commands due to HLD tokenizer re-quoting
- [BUG] bash negation fails in bash mode with grep (`if ! grep` does not parse correctly)
- [BUG] Bash tool hangs indefinitely (~25s timeout) when working directory is on NFS mount
- Per-tool-call helper process (claude.exe) leaks to 11.6GB anon RSS and is OOM-killed during a slow sandboxed Bash command
- [MODEL] xargs rm -rf without null delimiter caused data loss on paths with spaces
- Compound-command detector flags read-only `cd && <cmd>` patterns, blocking common workflows
- Sandboxed Bash commands get a spurious backslash before `!` (shell-quote re-escapes the eval wrapper)
- Bash tool silently returns empty output when /tmp/claude-$UID/ exceeds an auto-applied tmpfs quota (systemd ≥256 + kernel ≥6.6)
- [BUG] Bash sandbox fabricates phantom unreadable files when a hidden/denyRead path doesn't exist — breaks dotnet/SourceLink builds
- [BUG] --dangerously-skip-permissions ignored when SSH_CONNECTION is set or TERM is empty
- [BUG] Intentional kill of a backgrounded Bash task is reported as "failed" exit 144 with no way to mark cleanup as expected
- Parallel Bash batch: 4/7 calls return "internal error" after 14h silent gap; CLI process never restarted
- [BUG] Agents emit self-matching `pgrep -f` polling patterns that deadlock background tasks
- `!` injection: `&&` chain drops commands after sudo (works fine in fresh shell)
- [BUG] Bash tool returns empty output on RHEL 9 native Linux binary, shell snapshot never written
- Duplicate task-notification responses after TaskOutput consumption
- [Proposal] backgroundMaxElapsedSeconds — watchdog for Bash processes left by run_in_background (16 h silent zombie in auto mode)
- "Unhandled node type: array" emitted during bash tool call display
- [P1][Bug] Failed Bash tool call errors not displayed to user
- [BUG] Bash(cmd *) allowlist silently bypassed for commands interpolating user env vars; uninformative denial
- [BUG] Bash tool sends SIGTERM instead of SIGINT when cancelling commands, corrupting build state