Bash execution issues on Linux
Issues the maintainers labelled both platform:linux and area:bash.
253 issues · 75 open · 178 resolved (70%) · first seen Jan 3, 2026
Is this getting better or worse?
This class of problem is holding steady. 92 new reports in the last 90 days vs 88 in the 90 before — +5%. The open backlog peaked at 75 in 2026-10 and sits at 75 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
202 of these reports name the Claude Code build they were running, spanning 113 releases. Heaviest reporters:
- Claude Code v2.1.233
- Claude Code v2.1.205
- Claude Code v2.1.150
- Claude Code v2.1.288
- Claude Code v2.1.272
- Claude Code v2.1.220
- Claude Code v2.1.259
- Claude Code v2.1.158
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 34 days across 178 closures. Of the 178 closures with a recorded reason, 24% were closed as completed and 135 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
94 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] Bash comments break permissions
- Workaround: a PreToolUse hook can strip the comment lines before permission matching sees them. The hook reads the command, removes leading lines, and returns the clean command via . Your allowlist then matches correctly…
Found in the thread of #29582 · resolved - Background process termination crashes Claude Code in Docker containers
- …al to kill the process group (e.g., ), it kills itself too. Workaround Manually using to isolate background processes works: However, this loses Claude's background process monitoring and notification features. Suggested…
Found in the description of #16135 · still open - Bash(command:*) allow rules do not prevent permission prompts for file-modifying commands
- …in the desktop app ( , then ), and there's no config or UI workaround. Considering reopening this or filing a new issue — happy to do whichever the maintainers prefer.
Found in the thread of #20449 · resolved - [Bug] Agent spams no-op echo probe commands to flush shell output
- …h a real completion signal — never a burst of no-op echoes. Workaround in use: Added an explicit "never fire no-op probe commands" rule to global CLAUDE.md, but the model should not need this instruction — the default be…
Found in the description of #63887 · still open - [Bug] v2.1.117 regression: parallel Bash tool calls corrupt fd 3 in nested-Docker sandbox; permanent /proc/self/fd/3: Permission denied
- …, or timing. Filing what I've reproduced deterministically. Workaround Possibly related - 2.1.113 introduced the switch from "bundled JS" to "native Claude Code binary" per its release notes. The native binary's sandbox…
Found in the description of #51837 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–100
Ranked by community engagement (reactions weighted over comments).
- [BUG] Bash comments break permissions
- Background process termination crashes Claude Code in Docker containers
- Bash(command:*) allow rules do not prevent permission prompts for file-modifying commands
- [Bug] Agent spams no-op echo probe commands to flush shell output
- [Bug] v2.1.117 regression: parallel Bash tool calls corrupt fd 3 in nested-Docker sandbox; permanent /proc/self/fd/3: Permission denied
- Security heuristics override explicit permission allowlist
- Bash allowlist pattern 'Bash(curl *)' in settings.local.json not matching — repeated permission prompts
- Bash tool returns exit code 127 on every command in 2.1.147
- Doing useless tool call wasting token
- [BUG] Command parsing for permissions incorrectly handles # even when properly commented
- bypass permissions mode steers agents off Read/Edit/Grep onto composed shell strings, reintroducing quoting and exit-code failures that the structured tools cannot have
- [BUG] Bash permission pattern breaks when command contains parentheses
- Background tasks killed for "low memory" with 17.9 GB available (MemFree vs MemAvailable)
- Shell snapshots base64-encode function bodies, making obfuscated content indistinguishable from a malicious payload
- [BUG] Repeated Bash tool-call loop during git workflow consumed session limit
- Bash/Read tool results intermittently return empty (then flush late, redundantly) on Linux — NOT length/concurrency-correlated; same symptom as stale-closed #36038
- [BUG] Bash tool: exit 126 with "permission denied: /proc/self/fd/3" on Fedora 43 + zsh, blocks git writes, `ls -la`, `gh`
- [BUG] Bash and Read tool outputs arriving one turn late
- Bash tool does not inherit PATH from launching shell environment
- Bash permission glob matching breaks when command contains # character
- grep shell shim (claude-as-ugrep): unbounded memory growth on ERE bounded quantifiers {m,n} — OOMs the host
- Bash sandbox (bubblewrap) corrupts `!` to `\!` in commands, making the sandbox unusable for agentic workflows
- [BUG] Bash tool (Linux): pkill -f / pgrep -f match the tool's own bash -c … eval wrapper (exit 144, phantom PIDs); 2.1.214 guard covers only the CLI process
- [BUG] Linux: bashEditDiff shows a concurrent Claude session's edits, including ones made before the command started
- Temp-filesystem preflight false-positives ENOSPC on filesystems with >17.6 TB free (statfs 32-bit truncation)
- [BUG] sandbox auto-allow does not work vor env-prefixed commands
- [BUG] Not honoring SHELL variable when bash is not installed
- [BUG] Regression in 2.1.259: rg reading stdin in a pipeline is treated as a search of '.' and prompts (auto mode bypassed) when a Read() deny rule covers a file under the cwd
- [BUG] Bash sandbox fails to initialize on Ubuntu 24.04+ - conflict with the distro's default bwrap-userns-restrict AppArmor profile (not a Claude Code regression)
- Bash tool returns exit code 1 with no stdout/stderr on CachyOS (Arch Linux)
- [BUG] grep -r over any directory prompts on a Read(**/…) deny rule even when the tree contains no matching file (2.1.259)
- [BUG] Bash tool dispatch blocks the event loop ~80s in a CPU spin
- [BUG] Auto-mode safety classifier reports model "temporarily unavailable," blocking all Bash/WebSearch while normal generation works fine
- [BUG] Bash tool stdout containing data:image URLs is intercepted as image block, causing unrecoverable API 400 "Could not process image" session corruption
- Background tasks mass-killed by memory-pressure reaper on Linux hosts with low MemFree but high MemAvailable (PSI ~0)
- Worker fork / subagent is not woken by the completion of its LAST pending background task
- [BUG] Claude Code's Bash execution waits forever with no processes running
- Bash read-only commands (curl, gh) still prompt for permission despite allow rules
- Bash tool silently returns empty output when `/tmp/claude-$UID/` exceeds tmpfs quota
- Background task respawns infinitely when command hangs, causing fork bomb
- [BUG] Pipes silently broken in sandbox: shell-quoted "<" in oAD passes literal argument to eval instead of redirect
- [BUG] Bash tool persistently returns exit code 1 with no output in Claude Code session
- [BUG] Asked permission to run `cd /x/y/z && rm -rf *` in "bypass permissions" mode.
- Background Bash processes can run indefinitely with no visibility to user or model
- [BUG] Shell snapshot captures mise functions without `__MISE_EXE` variable, causing infinite fork recursion and OOM
- [BUG] Bash tool timeout kills Claude Code process (SIGTERM propagation), not just the child command
- Worktree isolation refuses git-free Bash on 2.1.272/2.1.273: literal-assigned variables, $(…) args, loops, heredocs after && (75 refusals in 3 days)
- [BUG] Opus deleted entire repository without realizing it (corrupt tool call?)
- [BUG] Permission parser treats # in multi-line quoted strings as shell comments
- [BUG] v2.1.105 shell snapshot contains 'set -o onecmd', causing all Bash tool calls to produce no output
- Bash tool: shell-quote mangles { }, heredoc markers, and $ in piped commands
- Bash tool timeout not enforced on piped commands
- Inline-shell rm check asks on bash -c with a $VAR command and a {…,…} argument (no rm present)
- Bash tool fails on every command: bwrap can't mkdir /run/containerd/containerd.sock (Permission denied)
- Bash-tool `grep` shim (ugrep emulation): catastrophic backtracking — 6.6 GB RSS / OOM kill on a 20 KB file
- [BUG] Embedded ugrep OOMs on bounded-repeat regex while Bash grep is silently shadowed (Linux, 2.1.205-2.1.212)
- PreToolUse hook `if` filter false-positives on complex Bash commands
- [Bug] grep shell wrapper silently overrides -E (ERE) with -G (BRE) via ugrep — breaks scripts using extended regex
- [BUG] Bash tool hangs and executes as background tasks in VSCode Copilot harness
- [BUG] Bare prompt 'changelog' can trigger recursive 'claude changelog' self-invocation, spawning hundreds of sessions and exhausting quota
- Claude Code sets VIRTUAL_ENV='' which breaks pixi-managed pre-commit hooks
- Shell snapshot $PATH not expanding — commands not found in Bash tool
- [Bug] Claude Code freezes during execution
- Shell becomes unusable when CWD is deleted (e.g. after git worktree remove)
- [Bug] Sandboxed shell commands freeze typing when executed in directories with many files
- Subagent Bash tool calls are never executed; run ends with terminal_reason "tool_deferred" while reporting success
- [BUG] Claude reports negative free space on large disks, due to integer overflow
- [Bug] Intermittent Bash command failures with exit code 1
- Shell snapshot uses unguarded $ZSH_VERSION, breaks set -u (nounset)
- [BUG] Claude code web Setup scripts: a failed script is recorded as success, its env exports don't reach agent shells, and its output is never logged
- [BUG] Heredoc as first argument bypasses pipe target permission checks
- [BUG] Bash tool fails silently when /tmp is full
- [BUG] Sandbox suggestion from the docs breaks Bash's working dir
- [BUG] aarch64 linux (al2023) bash tool process spawning completely broken
- [Bug] Session appears stuck when bash command disrupts network connectivity
- [BUG] Claude runs vitest in Node v18 but I installed v22 in my PC
- [BUG] [WORKAROUND] Shell snapshot duplicates -- separator when serializing alias with dash name
- [BUG] Allow bash commands with environment variables
- [BUG] Freezes terminal most of the time when trying to access anything remotely related to tty devices
- [Opus 4.6] Claude Code deleted all personal files with find / -delete during security test execution
- [Bug] Background task cleanup with sudo kills entire process tree instead of target process group
- Low-memory guard kills a backgrounded long build under healthy memory; running it detached (tmux) instead of run_in_background fixed it
- [BUG] Bash deny rules bypassed by any wrapper program outside ax()'s 8-item unwrap list
- Worktree-isolation guard: string-executor check matches every argument position, case-insensitively
- Per-tool-call helper process (claude.exe) leaks to 11.6GB anon RSS and is OOM-killed during a slow sandboxed Bash command
- Headless -p session leaks to 10-15GB RSS while idle on long-running background Bash tasks (v2.1.205, Linux)
- [BUG] Shell snapshot leaking definitions into stdout
- [BUG] Model emits fish-syntax to Bash tool when login shell is fish
- [MODEL] xargs rm -rf without null delimiter caused data loss on paths with spaces
- Compound-command detector flags read-only `cd && <cmd>` patterns, blocking common workflows
- Sandboxed Bash commands get a spurious backslash before `!` (shell-quote re-escapes the eval wrapper)
- Bash tool silently returns empty output when /tmp/claude-$UID/ exceeds an auto-applied tmpfs quota (systemd ≥256 + kernel ≥6.6)
- [BUG] Bash sandbox fabricates phantom unreadable files when a hidden/denyRead path doesn't exist — breaks dotnet/SourceLink builds
- [BUG] `normalizeToolInput` strips `cd <cwd> &&` from Bash commands before PreToolUse hooks can inspect them
- [BUG] Bash tool dispatch with sandbox stalls 8-16s between permission decision and shell spawn; UI frozen during stall
- [Bug] Working directory not reset between bash command executions
- Bash-tool snapshot-source wrappers accumulate during subagent dispatch, triggering process-cascade OOM
- [BUG] Unbounded memory usage in LXD VMs where tool calling is used (CLI + VSCode Extension)
- Terminal becomes unresponsive when running grep on external SSD
- [BUG] Title: Bash tool: third-party CLI binaries silently fail (exit 1, no output) even with dangerouslyDisableSandbox: true