Security issues on macOS
Issues the maintainers labelled both platform:macos and area:security.
699 issues · 146 open · 553 resolved (79%) · first seen May 17, 2025
Is this getting better or worse?
This class of problem is still growing. 264 new reports in the last 90 days vs 138 in the 90 before — +91%. The open backlog peaked at 146 in 2026-08 and sits at 146 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
379 of these reports name the Claude Code build they were running, spanning 132 releases. Heaviest reporters:
- Claude Code v2.1.170
- Claude Code v2.1.198
- Claude Code v2.1.212
- Claude Code v2.1.201
- Claude Code v2.1.207
- Claude Code v2.1.12
- Claude Code v2.1.202
- Claude Code v2.0.76
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 36 days across 553 closures. Of the 553 closures with a recorded reason, 23% were closed as completed and 425 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
129 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] VS CODE Extension no longer allows --dangerously-skip-permissions
- …ce with the newly updated Claude Code VSCode extension, the workaround with Ctrl+C and running 'claude --dangerously-skip-permissions' it does not work anymore. I've tried setting an alias in zshrc, but it does not work…
Found in the thread of #8539 · resolved - Skills/subagents do not inherit user-level permissions from settings.json
- …macOS 26.2 (25C56) - Settings file: ~/.claude/settings.json Workaround Select option 2 to create workspace-level permissions, but this defeats the purpose of user-level permissions. Impact Significantly degrades user exp…
Found in the description of #18950 · still open - [BUG] macOS sandbox blocks Security.framework TLS verification, breaking Go binaries (gh, terraform, etc.)
- …is script that patches the locally installed Claude Code to work around this bug: You would need to rerun this script every time Claude Code updates to re-apply the patch but it might help someone in the meantime.
Found in the thread of #23416 · still open - Skill allowed-tools doesn't grant permission for Bash commands
- …denied: The command attempted matches the pattern exactly: Workaround Adding directly to the global allow list works, but defeats the purpose of skill-scoped . Environment - Claude Code version: 2.0.75 - OS: macOS (Darw…
Found in the description of #14956 · still open - [BUG] permissions from user settings.json is NOT applied at project level
- …permissions should be a setting, not a mode. So I tried to workaround by adding permissions and it doesn't use them.
Found in the thread of #5140 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–100
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 699 matches; the statistics above cover all 699.
- [BUG] VS CODE Extension no longer allows --dangerously-skip-permissions
- Skills/subagents do not inherit user-level permissions from settings.json
- [BUG] macOS sandbox blocks Security.framework TLS verification, breaking Go binaries (gh, terraform, etc.)
- [Bug] Potential session/cache leakage between workspace instances or consumer accounts
- Skill allowed-tools doesn't grant permission for Bash commands
- [BUG] permissions from user settings.json is NOT applied at project level
- [BUG] Respect `allowed-tools` when using combined / piped tool commands
- [BUG] Anthropic embedded spyware in Claude Code
- Git commit permission prompt appears repeatedly despite allow tools configuration
- [BUG] Native Claude Code not using system certs on MacOS
- VS Code Extension Ignores Global dangerously-skip-permissions Setting
- Wildcard Permission Matching Failure for Curl Commands in Claude Code
- [BUG]
- [SECURITY] PreToolUse hooks not enforced on subagent tool calls, allowing security bypass
- [BUG] Allowed write commands (e.g. mkdir) still prompt for permission
- [BUG] OAuth credentials shared across CLAUDE_CONFIG_DIR profiles causing data isolation failure (compliance risk)
- [BUG] Edit(.git/**) permission doesn't allow git to write .git/config in sandbox
- [BUG] AUP/cyber-safeguard false positives on legitimate own-software hardening; one hit contaminates entire session
- Marketplace plugin sync triggers YubiKey presence, undermining hardware key security model
- [Critical] Claude Code Glob patterns (/**) in settings.local.json don't work - breaks developer workflow
- [BUG] you stupid agent used my real email as user agent string without asking anything
- Claude for Chrome extension triggers repeated macOS Gatekeeper warnings for .node files
- ralph-wiggum plugin: Bash command permission check fails on multi-line scripts with newlines
- [BUG] Claude Code can access denied files
- [BUG] TClaude Code ignores file access restrictions in settings.json
- Tool permissions not recognized when running commands in git worktrees
- [BUG] Bash(git commit:*) in allowedTools during claude -p mode isn't respected.
- [Bug] macOS brew upgrade requires bypassing security to launch Claude Code
- [Bug] Sandbox blocks uv cache access during pytest execution
- Permission bypass when commands are chained with &&
- [Bug] Background subagent tool calls exposed in parent context window
- Xcode MCP tools requiring Automation permission hang indefinitely for CLI clients without bundle identifiers
- [BUG] Hooks fail with posix_spawn '/bin/sh' ENOENT due to sandbox restrictions
- [Bug] Session token limit reached prematurely after upgrade to v2.0.64
- Skill loading executes inline bash patterns from documentation examples
- Plan mode restrictions can be bypassed by LLM
- [BUG] macOS Keychain: security -i 4096-byte line buffer causes credential corruption with MCP OAuth plugins
- [BUG] Claude Code reads .env files and hardcodes secrets into inline scripts
- [BUG] NODE_EXTRA_CA_CERTS is not effective when set in ~/.claude/settings.json
- [BUG] Persistent AUP false positives — 40+ per 4 sessions, across unrelated projects (psychology book, web app, infra, bot)
- Bug: .claude.json automatically stores conversation history when it shouldn't
- [Suspicious Behavior]: Hidden <system-reminder> 10,000+ injections consuming 15%+ of context window without user knowledge or consent
- [BUG] SANDBOX: Cannot express “workspace-only filesystem access” with current sandbox rules
- [BUG] SSL certificate configuration don't work with web page `Fetch` (but works with MCP)
- [BUG] Claude Code Sandbox Bypass Security Breach
- [BUG] Privacy & filesystem access | Claude Code requests macOS TCC access to Desktop / Documents / Downloads / iCloud Drive with no apparent trigger
- [BUG] Unknown plugin "fizz@testmkt-marketplace" appeared in blocklist.json without user installation [MAC] [LINUX
- [BUG] Claude should not clone claude-plugins-official.git with SSH
- WebFetch summarizer emits <system-reminder> blocks in tool output, violating harness trust boundary
- Allow opting out of the per-Read "malware" system-reminder — defense is porous and cost is non-consensual
- [BUG] Command permission system doesn't recognize pytest variations as the same operation
- [BUG] backticks and exclamations in a slash command trigger permission check
- [BUG] project's .claude/settings.local.json does not work
- [BUG] CC keeps asking for permission when square brackets are in the file name
- [BUG] Inconsistent Network Behavior and Unclear UX in Default Cloud Environment
- [Bug] Fable 5 safety classifier false-positives on authorized defensive security audits
- [FEATURE] Automatic `gh pr view` polling bypasses the permission system and cannot be disabled
- VSCode Extension: Permissions not persisting
- PreToolUse hooks with preventContinuation:true are not blocking tool execution
- dangerouslyDisableSandbox bypasses sandbox without user approval prompt
- Regression: Read tool now requires permission prompts despite documentation
- [BUG] SSL certificate has expired not working since 2.1.190+ on mac
- [BUG] disableBypassPermissionsMode in managed-settings.json has no effect (v2.1.92)
- False Positive: Security Hook Blocking Write Tool on Non-Code Files
- [Bug] API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy
- Critical Authorization Failure: Claude bypasses rule-based commit authorization despite explicit restrictions
- [BUG] SSH remote connector fails with "Host denied (verification failed)" after server host key rotation — no re-trust prompt shown
- excludedCommands glob matching unsandboxes entire shell invocation, enabling sandbox escape via command chaining
- [BUG] Network requests outside of sandbox don't trigger `PermissionRequest` hook
- Project-scoped MCP servers don't trigger approval prompt
- Security: ~/.claude/CLAUDE.md is writable by any user-level process, enabling persistent prompt injection
- [BUG] `claude mcp add` expands environment variable placeholders and writes resolved values to .mcp.json
- [BUG] Using dangerously-skip-permissions on a new folder skips trust check and breaks hooks
- crud
- Security Permissions Bypass in Bash File Access Restrictions
- [BUG] Need better way to restrict subagent tool use
- [FEATURE] Support wildcard/regex for `sandbox.network.allowUnixSockets` on macOS
- [BUG] Claude Code could read the .env content even .claude/settings.json is configured
- [Bug] Anthropic API Error: Incorrect Usage Policy Violation Detection
- [BUG] Claude Code loads and exports .env on startup, even with read permissions denied
- macOS TCC permission prompts show "2.1.201" as the app name, and grants reset on every version update
- Sub-agents can escalate permission mode beyond parent session (default → auto)
- dangerouslyDisableSandbox: true does not prompt for user confirmation
- [Bug] Write tool bypasses user allowlist by using cat+mv workaround instead of atomic writes
- [BUG] VSCode Plugin New UI Permission Issue
- [BUG] "don't ask again for find commands"
- [BUG] kubectl command patterns not matching despite correct allow rules
- [BUG] Global settings seem to be getting ignored when doing simple commands like running ls in bash
- [BUG] Opus 4.8 fabricates user turns across 3 related sessions — one executed a real unauthorized commit+push on a fabricated confirmation (JSONL-verified)
- Phantom session rows + unauthenticated localhost bridge accepts writes from any local process
- Path-pattern scanner false-positives on macOS usernames containing `.`, and "always allow" option fails to persist a rule (Bash and Write only; Edit unaffected)
- Sandbox: allowedDomains not enforced for plain HTTP — only HTTPS CONNECT is filtered
- [BUG] PreToolUse hooks not triggered for @file reference reads
- [BUG] OAuth token refresh fails due to Keychain permission errors (possibly after updates)
- [BUG] statusline-setup agent assumes incorrect username '/Users/mustafa'
- Permission Pattern Matching Fails for PHP Commands with Complex Arguments
- [BUG] Setting NODE_EXTRA_CA_CERTS breaks claude code
- [BUG] Read() bypasses .claude/claude.json and .gitignore restrictions for ignored files
- [BUG] Remote Control bridge registration sent as plaintext HTTP through proxy instead of CONNECT-tunneling
- [BUG] Critical: sandbox.filesystem.denyRead does not prevent credential exposure