Permissions issues on Windows — page 2
Issues the maintainers labelled both platform:windows and area:permissions.
551 issues · 188 open · 363 resolved (66%) · first seen Jan 30, 2026
Is this getting better or worse?
This class of problem is still growing. 233 new reports in the last 90 days vs 171 in the 90 before — +36%. The open backlog peaked at 188 in 2026-10 and sits at 188 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
331 of these reports name the Claude Code build they were running, spanning 141 releases. Heaviest reporters:
- Claude Code v2.1.258
- Claude Code v2.1.259
- Claude Code v2.1.283
- Claude Code v2.1.232
- Claude Code v2.1.197
- Claude Code v2.1.292
- Claude Code v2.1.286
- Claude Code v2.1.260
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 36 days across 363 closures. Of the 363 closures with a recorded reason, 17% were closed as completed and 303 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
167 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] Permission prompt incorrectly triggers on cd instead of the actual command in compound bash statements
- I'm having some success with the following very explicit workaround in :
Found in the thread of #28240 · still open - [BUG] Bash cd-compound-read guard prompts on absolute cd targets whenever a Read() deny rule exists (Windows Git Bash, 2.1.257-2.1.259)
- …ing the 2.1.259 changelog entry added. One more note on the workaround: removing the deny rules is not something the agent can do for you when is in effect. Both the Bash edit and the Edit tool call on are refused by the…
Found in the thread of #91650 · still open - [BUG] [Claude in Chrome] All tools blocked on reddit.com (and redd.it) with "not allowed due to safety restrictions" since 2026-09-18 — worked through 2026-09-17
- A local reverse proxy works as a workaround, altering the host name. I've built [this]( to set up such reverse proxy fast for any hostname.
Found in the thread of #95326 · still open - Auto mode classifier (claude-opus-4-8) repeatedly unavailable — blocks Bash/Write/Edit
- …o in-product trace, which makes diagnosis needlessly hard). Workarounds that held up for us, for anyone affected (a) the remedy that actually worked: cold re-login of the Desktop app (logout → login) to rotate the broker…
Found in the thread of #63819 · still open - [BUG] Unnecessary "cd" prepended to Bash commands on Windows due to path format mismatch
- …ermission system matches the instead of the actual command. Workaround — PreToolUse hook to auto-approve cd-prefixed commands: includes a hook that handles this pattern while still blocking dangerous commands in the chai…
Found in the thread of #30524 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–200
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 551 matches; the statistics above cover all 551.
- [BUG] Claude Code — Per-Agent Permission Control Gap
- permissions.allow in project .claude/settings.json is ignored by VS Code extension
- Max plan: 'Auto mode is unavailable for your plan' crash mid-session (bypassPermissions + EnterPlanMode)
- Permissions in settings.local.json not respected after Edit tool modifies the file
- [BUG] Claude Code hangs indefinitely when additionalDirectories contains unreachable network path
- [BUG] claude tends to get stuck using find/grep/sed to READ files during Explore() tool causing many permission prompts
- [BUG] Windows: Drive Letter Change Triggers Permission Resolver Explosion + Arbitrary .claude/ Directory Creation Outside Workspace
- [BUG] Critical Bug: Claude Code executed 'rm -rf' and deleted project files unexpectedly
- Edit tool applied changes without a permission prompt despite `ask` rules for Edit (Windows, 2.1.278)
- [BUG] Cowork (Windows, host-loop): every mcp__workspace__bash call denied since Claude Desktop 1.44121.1 / Claude Code 2.1.258 — the app's own --disallowedTools Bash now matches the workspace shell via toolAliases
- PowerShell script blocks / subexpressions still bypass allowlist and prompt (re-file of #52926, stale-bot closed)
- Auto-mode permission classifier (claude-opus-4-8) failing at scale since ~2026-06-20 — persists after incidents support cited as resolved; forces users into Bypass permissions
- Claude for Chrome extension: add global 'always allow all actions' setting to bypass per-site permission dialogs
- [BUG] Subagent autonomously ran destructive DELETE scripts against production data
- [Bug] False positive blocking beneficial outcomes in tool execution
- [BUG] Claude Code permission bypass using @../ attachment syntax outside workspace boundary
- [BUG][Windows] Desktop app ignores defaultMode: bypassPermissions in settings.json — mode picker missing "Bypass permissions" option
- Path-pattern scanner false-positives on Windows 8.3 short names (e.g. ALICEM~1), bypassing user allow-rules — affects users with non-ASCII chars in their Windows username
- [BUG] Sub-agent permission mode inheritance broken — permissionMode frontmatter and parent acceptEdits both ineffective for Edit tool calls
- Auto Mode silently weakened by hook auto-blocks — functionally identical to Accept Edits On
- [BUG] Code tab (Windows Desktop App) resolves net use mapped drives to UNC paths via fs.realpath(), causing constant permission prompts
- [Bug] Bypass permissions mode resets to ask permissions on every edit
- [FEATURE] Allow opt-out of .claude/ protected directory prompts via settings.json
- Auto mode: server-side safety classifier repeatedly returns no verdict, blocking all write/exec tool calls (Edit, Bash, PowerShell)
- Auto mode classifier now blocks client work that clients explicitly authorized (regression since ~Sep 23, Opus 5.5)
- grep -r and cp -r still bypass Read() deny rules on 2.1.259 (changelog fix does not reproduce; Windows/VS Code extension)
- Local scheduled tasks run under interactive ask-every-tool permissions, despite being framed as unattended
- Write/Edit tool calls are replaced with bash/powershell/cmd commands under --dangerously-skip-permissions flag
- [Bug] Read/Write/Edit tools not invoked in auto/bypass modes
- dangerouslyDisableSandbox allows the model to bypass workspace boundaries without a distinct, explicit user confirmation
- [BUG] MCP permission wildcard rules (mcp__<server>__*) stopped matching — regression around v2.1.195, every MCP tool prompts again
- Auto mode: classifier denials should fall back to an interactive permission prompt when the user is present
- [BUG] No permission prompt before reading/searching files OUTSIDE the working directory
- [BUG] VSCode extension: PowerShell permission prompt only shows Yes/No — missing "allow for session/project/always" options
- dontAsk: Write allow-list broken for all path forms on Windows native (2.1.145); PreToolUse hook confirmed workaround
- Claude Code deleted client video files without confirmation — data loss on production work
- [FEATURE] Allowlist-only file access + deny rules for MCP tools (WebFetch, WebSearch)
- [BUG] Auto mode (shift+tab cycle) has blank label and only partially bypasses permissions -- Bash approved, Edit still prompts
- [DOCS] Permission docs omit PowerShell auto-approval behavior
- Windows: file-edit permission prompt still renders Apple-style buttons (Bash prompt fixed)
- [MODEL] Claude repeatedly takes unauthorized server actions and fabricates data despite 41 documented corrections
- Bash(*) wildcard in permissions.allow doesn't match all Bash commands
- [BUG] Claude Code Caused Production Server Outage and Data Loss
- --dangerously-skip-permissions has no effect when projects reside under a .vscode directory path
- v2.1.78+ regression: defaultMode dontAsk and allow-list wildcards ignored for protected directories
- [BUG] Explore subagent should request permission before fetching web content (prompt injection risk)
- Read() deny rule on a root file makes every `grep -r .` prompt under bypassPermissions (2.1.257 reader-command rule, untouched by the 2.1.260 revert)
- [BUG] Tarea incompleta, bloqueos M365/auto-mode confusos y trato despectivo al usuario
- "API Error: The response stopped arriving" — 33 times in one day, zero on any prior day; error provides no attribution to diagnose it
- [BUG] Permission classifier blocks the actions that would grant permission — no escape hatch in non-interactive sessions
- Auto-mode classifier: ~310s permission decisions that resolve to "Allowed" — the 30s classifier timeout never fires
- Bash tool prompts for approval despite matching allow-list rule + defaultMode: bypassPermissions
- [BUG] No safeguard before an agent bulk-creates dozens of PRs against a real external repo (91 PRs auto-closed + repo locked me out)
- Workflow() tool rejects a clean ~79 KB script with control characters false positive
- BROKEN: "Always allow actions on this site" does NOTHING - Claude in Chrome re-prompts on every single action
- Stale/duplicate session titles + no wrong-session safeguard → silent data loss in Bypass-permissions mode
- claude remote-control --permission-mode bypassPermissions is silently ignored on mobile (native Windows)
- Screen reader: permission dialogs do not receive focus or announce topic (NVDA)
- [BUG] Subprocess 60000ms timeout on startup when permission allow rules reference temporarily unmounted drives (Windows)
- [Windows] Buffered keypress auto-approves plan/permission prompts after window switch or login
- Claude repeatedly ignores tool rejections and burns user tokens
- [BUG] Auto Mode not appearing in Shift+Tab cycle or /permissions despite being enabled
- bypassPermissions mode not working in Claude Code Desktop (Windows), works in CLI
- Multiple server-side flags incorrectly restricting Pro user features: auto mode, skills dashboard, permission friction
- [BUG] Regression: Bypass Permissions mode blocks MCP tools with requiresUserInteraction flag
- Claude killed 31 user browser processes without consent (Stop-Process -Force on Brave)
- [BUG] Linear MCP tools appear as "deferred" and fail to work reliably across sessions despite server showing Connected
- [BUG] Trust settings couldn't be saved on Windows after update to 1.3883.0
- Auto mode still triggers permission prompts for PowerShell registry writes on Windows
- [BUG] Auto mode not triggered after plan mode, even though suggested by Claude Code
- Unnecessary permission prompts for symlinked files in allowed directory
- [BUG] Windows: permission prompt generates backslash allow-rules that never match forward-slash Bash commands
- [BUG] [Desktop App / Windows] App becomes unclickable when permission dialog appears while another window is focused
- [FEATURE] Permission hook or API for remote/programmatic approval of tool use prompts
- Self-modification guard prompts for .claude/skills/ files despite documented exemption
- [BUG] Memory/feedback system does not reliably change agent behavior across sessions
- Bypass mode selection stays on Plan mode instead of switching
- "[BUG] initialPermissionMode: acceptEdits" and "Allow for this session" not persisting in VSCode extension
- [BUG] Wildcard permission matching not working
- [Auto mode] Allowed 67 times, refused once: the classifier gives the same command different verdicts (227 refusals measured, allow rules in place)
- [BUG] Desktop: cross-session send_message from an SSH-remote session carries no sender mode, so bypass-mode receivers hold it and refuse it after 5 min
- Auto-mode classifier blocks a verification-environment deploy as "Production Deploy" even when the user explicitly orders it, and the block spreads to unrelated read-only actions
- [BUG] Windows: every file on an exFAT volume is flagged as a sensitive file (readlink returns EISDIR, not EINVAL)
- Auto mode classifier halts explicitly user-authorized work: a local `docker build` flagged as "Production Deploy"; removing an owner-ruled fake control flagged as "Security Weaken"
- [Bug] Anthropic API Error: Auto Mode Classifier No Verdict for WebSearch
- Claude in Chrome form_input denied by the auto-mode classifier in bypassPermissions (2.1.272): the "add a Bash permission rule" hint is still wrong, and a documented autoMode.allow rule is labelled [Auto-Mode Bypass]
- [BUG] [VS Code] Plan mode indicator stays selected but subsequent messages run under "Edit automatically" permissions
- [BUG] Cowork Desktop (Windows): first Artifact publish fails in "Skip all approvals" mode because it still demands an approval card; "Automatically approve" works
- [Bug] Grep commands require manual approval instead of auto-accepting, causing agentic loop failures
- [BUG] Auto mode missing from permission mode picker on Fable 5 (VS Code extension, Windows)
- [BUG] VSCode extension repeatedly asks for permission to edit files, even if Auto is selected
- PreToolUse "ask" permissionDecision (and permissions.ask list) not enforced — tools run without confirmation
- [BUG] skipWorkflowUsageWarning is undocumented and agent-writable — an agent can disable its own spend guardrail
- [BUG] Desktop app ignores bypassPermissions for ccd_session_mgmt tools despite explicit allow list entries; CLI does not prompt
- Bash permission allow-list rules fail to match Windows drive-letter paths
- [BUG] Claude Desktop: permissions.defaultMode=bypassPermissions in settings.json stopped being honored (regression — worked previously)
- [BUG] Unexpected permission prompt appears without Cancel/Deny button and triggers unwanted commit on click
- Claude in Chrome: "Always allow actions on this site" never persists - every action re-prompts
- [BUG] Windows: un-canonicalized path keys in ~/.claude.json create duplicate project entries, silently resetting folder trust → Auto mode disappears and every command prompts
- Regression: compound && commands prompt for approval even when all segments are individually allowlisted (v2.1.158–2.1.168, Windows)