Permissions issues on Windows — page 2
Issues the maintainers labelled both platform:windows and area:permissions.
391 issues · 106 open · 285 resolved (73%) · first seen Jan 30, 2026
Is this getting better or worse?
This class of problem is converging. 156 new reports in the last 90 days vs 215 in the 90 before — -27%. The open backlog peaked at 106 in 2026-08 and sits at 106 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
219 of these reports name the Claude Code build they were running, spanning 105 releases. Heaviest reporters:
- Claude Code v2.1.232
- Claude Code v2.1.233
- Claude Code v2.1.81
- Claude Code v2.1.197
- Claude Code v2.1.119
- Claude Code v2.1.114
- Claude Code v2.1.78
- Claude Code v2.1.63
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 35 days across 285 closures. Of the 285 closures with a recorded reason, 19% were closed as completed and 232 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
121 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] Permission prompt incorrectly triggers on cd instead of the actual command in compound bash statements
- I'm having some success with the following very explicit workaround in :
Found in the thread of #28240 · still open - Auto mode classifier (claude-opus-4-8) repeatedly unavailable — blocks Bash/Write/Edit
- …o in-product trace, which makes diagnosis needlessly hard). Workarounds that held up for us, for anyone affected (a) the remedy that actually worked: cold re-login of the Desktop app (logout → login) to rotate the broker…
Found in the thread of #63819 · still open - [BUG] Unnecessary "cd" prepended to Bash commands on Windows due to path format mismatch
- …ermission system matches the instead of the actual command. Workaround — PreToolUse hook to auto-approve cd-prefixed commands: includes a hook that handles this pattern while still blocking dangerous commands in the chai…
Found in the thread of #30524 · resolved - --dangerously-skip-permissions does not bypass Edit permission prompts
- …oth scoped and unscoped options are offered inconsistently. Workaround Moving to the parent project settings ( ) resolves the issue, but this is overly broad — it affects all sub-projects when only one should have bypass…
Found in the description of #36192 · resolved - Permission system UX: compound command blocking, rule accumulation, undiscoverable Bash(*) fix
- …th anything. Still prompts for the whole string every time. Workaround in case it helps anyone hitting this thread: a PreToolUse hook that re-splits the command on shell separators (quote-aware, bails out on /backticks)…
Found in the thread of #31523 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–200
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 391 matches; the statistics above cover all 391.
- [BUG] Auto mode (shift+tab cycle) has blank label and only partially bypasses permissions -- Bash approved, Edit still prompts
- Path-pattern scanner false-positives on Windows 8.3 short names (e.g. ALICEM~1), bypassing user allow-rules — affects users with non-ASCII chars in their Windows username
- Windows: file-edit permission prompt still renders Apple-style buttons (Bash prompt fixed)
- [MODEL] Claude repeatedly takes unauthorized server actions and fabricates data despite 41 documented corrections
- Bash(*) wildcard in permissions.allow doesn't match all Bash commands
- [BUG] Claude Code Caused Production Server Outage and Data Loss
- --dangerously-skip-permissions has no effect when projects reside under a .vscode directory path
- v2.1.78+ regression: defaultMode dontAsk and allow-list wildcards ignored for protected directories
- [BUG] Explore subagent should request permission before fetching web content (prompt injection risk)
- dangerouslyDisableSandbox allows the model to bypass workspace boundaries without a distinct, explicit user confirmation
- [BUG] MCP permission wildcard rules (mcp__<server>__*) stopped matching — regression around v2.1.195, every MCP tool prompts again
- Screen reader: permission dialogs do not receive focus or announce topic (NVDA)
- Auto mode: classifier denials should fall back to an interactive permission prompt when the user is present
- [BUG] VSCode extension: PowerShell permission prompt only shows Yes/No — missing "allow for session/project/always" options
- dontAsk: Write allow-list broken for all path forms on Windows native (2.1.145); PreToolUse hook confirmed workaround
- Claude Code deleted client video files without confirmation — data loss on production work
- [FEATURE] Allowlist-only file access + deny rules for MCP tools (WebFetch, WebSearch)
- bypassPermissions mode not working in Claude Code Desktop (Windows), works in CLI
- Multiple server-side flags incorrectly restricting Pro user features: auto mode, skills dashboard, permission friction
- [BUG] Regression: Bypass Permissions mode blocks MCP tools with requiresUserInteraction flag
- Claude killed 31 user browser processes without consent (Stop-Process -Force on Brave)
- [BUG] Linear MCP tools appear as "deferred" and fail to work reliably across sessions despite server showing Connected
- [DOCS] Permission docs omit PowerShell auto-approval behavior
- [BUG] Trust settings couldn't be saved on Windows after update to 1.3883.0
- Auto mode still triggers permission prompts for PowerShell registry writes on Windows
- [BUG] Auto mode not triggered after plan mode, even though suggested by Claude Code
- Unnecessary permission prompts for symlinked files in allowed directory
- [BUG] Windows: permission prompt generates backslash allow-rules that never match forward-slash Bash commands
- [BUG] [Desktop App / Windows] App becomes unclickable when permission dialog appears while another window is focused
- [FEATURE] Permission hook or API for remote/programmatic approval of tool use prompts
- Self-modification guard prompts for .claude/skills/ files despite documented exemption
- [BUG] Memory/feedback system does not reliably change agent behavior across sessions
- Bypass mode selection stays on Plan mode instead of switching
- "[BUG] initialPermissionMode: acceptEdits" and "Allow for this session" not persisting in VSCode extension
- [BUG] Wildcard permission matching not working
- Local scheduled tasks run under interactive ask-every-tool permissions, despite being framed as unattended
- Auto-mode classifier: ~310s permission decisions that resolve to "Allowed" — the 30s classifier timeout never fires
- Bash tool prompts for approval despite matching allow-list rule + defaultMode: bypassPermissions
- [BUG] No safeguard before an agent bulk-creates dozens of PRs against a real external repo (91 PRs auto-closed + repo locked me out)
- Workflow() tool rejects a clean ~79 KB script with control characters false positive
- PowerShell script blocks / subexpressions still bypass allowlist and prompt (re-file of #52926, stale-bot closed)
- BROKEN: "Always allow actions on this site" does NOTHING - Claude in Chrome re-prompts on every single action
- Claude in Chrome: "Always allow actions on this site" never persists - every action re-prompts
- Stale/duplicate session titles + no wrong-session safeguard → silent data loss in Bypass-permissions mode
- claude remote-control --permission-mode bypassPermissions is silently ignored on mobile (native Windows)
- [BUG] Subprocess 60000ms timeout on startup when permission allow rules reference temporarily unmounted drives (Windows)
- [BUG] Windows: un-canonicalized path keys in ~/.claude.json create duplicate project entries, silently resetting folder trust → Auto mode disappears and every command prompts
- [Windows] Buffered keypress auto-approves plan/permission prompts after window switch or login
- [BUG] Deny rules in settings.json are not enforced — denied files and commands remain accessible`
- Claude repeatedly ignores tool rejections and burns user tokens
- [BUG] Auto Mode not appearing in Shift+Tab cycle or /permissions despite being enabled
- [BUG] Permission preview flickers / scroll snaps back when reviewing long Write or Edit tool-call content
- [BUG] --dangerously-skip-permissions does not bypass project-level "ask" rules in .claude/settings.json
- [BUG] Auto-mode classifier: session-level trust decay + hard-rail misattributed as user rejection (Windows, v2.1.138)
- [BUG] Claude Desktop on Windows: PowerShell tool call permission prompt delayed ~2m35s before appearing
- [BUG] - permissions.deny entries for Edit/Write are not enforced (Windows, v2.1.138)
- [BUG] Toast notification Allow/Deny buttons are no-ops; permission must still be granted in Code. Very annoying.
- ExitPlanMode dialog buttons unresponsive (Clear-context-and-bypass / Proceed) + plan auto-executes in unrelated open terminal
- [BUG] Claude reads rules but don't follow it.
- [BUG] Enterprise managed settings (HKLM) are not applying
- [Bug] Dispatch repeatedly prompts for permission bypass despite account-level bypass rules configured
- Trust dialog repeats every launch on Windows 11 22H2 (OS-specific bug)
- [BUG] Bypass Permissions mode not supported when choosing to accept a plan
- [BUG] Write deny rules behave as ask — file creation is prompted instead of automatically blocked; also affects organization-managed settings
- [Bug] Auto-mode prevents basic function execution
- [BUG] Malformed settings.json files are silently skipped if they become incorrect after session startup.
- [Bug] Agents waste excessive token budget on permission checks without early validation
- UNC path check false-positive blocks WSL paths even with bypassPermissions
- [BUG] Prompt was 3X the size of my screen in claude desktop (code section).
- [BUG] Edit permission in settings.local.json not respected - confirmation dialog still appears
- [BUG] Desktop app UI freezes on permission prompt — Windows, requires force close
- [Bug] Permission allow rules not applied for Bash(mkdir) in skill contexts and default mode
- PreToolUse hooks: two Windows bugs — echo corrupts JSON, pre-approved permissions bypass hooks
- UX: 'auto mode is unavailable for your plan' message shown unnecessarily
- [BUG] IDE file-open events cancel pending tool permission prompts
- [BUG] Bash deny rules appear non-recursive for nested execution contexts ($(), backticks, subshell, eval, PowerShell wrapper)
- [BUG] allowedTools restrictions not enforced — Claude reads files without approval prompt
- [BUG] Security violation by design - leaking project details, memory on global scale
- [BUG] settings.local.json corrupted by improperly escaped Bash permission entries containing quotes inside regex patterns
- [Bug] Dangerous misinterpretation of file deletion request resulted in unintended --force-reset execution
- [BUG] Claude Code hangs after update on 28 feb 2026
- [BUG] CLAUDE.md rules ignored despite being loaded - Agent executes unauthorized actions
- Write/Edit tool calls are replaced with bash/powershell/cmd commands under --dangerously-skip-permissions flag
- [BUG] VSCode extension repeatedly asks for permission to edit files, even if Auto is selected
- [BUG] Desktop Browser pane: a site on the "Allowed sites" list still raises a permission card on every tool call in Auto mode, claiming site permissions are disabled
- PreToolUse "ask" permissionDecision (and permissions.ask list) not enforced — tools run without confirmation
- [BUG] Desktop app ignores bypassPermissions for ccd_session_mgmt tools despite explicit allow list entries; CLI does not prompt
- Bash permission allow-list rules fail to match Windows drive-letter paths
- [BUG] Claude Desktop: permissions.defaultMode=bypassPermissions in settings.json stopped being honored (regression — worked previously)
- [BUG] Unexpected permission prompt appears without Cancel/Deny button and triggers unwanted commit on click
- Regression: compound && commands prompt for approval even when all segments are individually allowlisted (v2.1.158–2.1.168, Windows)
- VS Code extension ignores settings.json allow list and bypassPermissions for UNC network path file edits
- [BUG] Unauthorized git push to production
- Desktop launches CLI without --dangerously-skip-permissions despite defaultMode: bypassPermissions
- [BUG] "Allow Dangerously Skip Permissions" overrides plan mode in VS Code extension
- [BUG] Claude wrote files to system temp folder (AppData\Local\Temp) without disclosure
- [Bug] Sub-agent `rm -rf` with case-insensitive path collision destroys workspace; no sandbox, confirmation, or orchestrator interception
- [BUG] AskUserQuestion permission stream closes before response - "Unhandled case: [object Object]" in VS Code extension
- [DOCS] [additionalDirectories] Read/Edit tools denied on mapped network drives — fixed in v2.1.133
- Subagent Bash auto-approval regressed between runtime 2.1.121 and 2.1.128 under "Accept edits" mode