Permissions issues on Windows — page 3
Issues the maintainers labelled both platform:windows and area:permissions.
551 issues · 188 open · 363 resolved (66%) · first seen Jan 30, 2026
Is this getting better or worse?
This class of problem is still growing. 233 new reports in the last 90 days vs 171 in the 90 before — +36%. The open backlog peaked at 188 in 2026-10 and sits at 188 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
331 of these reports name the Claude Code build they were running, spanning 141 releases. Heaviest reporters:
- Claude Code v2.1.258
- Claude Code v2.1.259
- Claude Code v2.1.283
- Claude Code v2.1.232
- Claude Code v2.1.197
- Claude Code v2.1.292
- Claude Code v2.1.286
- Claude Code v2.1.260
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 36 days across 363 closures. Of the 363 closures with a recorded reason, 17% were closed as completed and 303 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
167 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] Permission prompt incorrectly triggers on cd instead of the actual command in compound bash statements
- I'm having some success with the following very explicit workaround in :
Found in the thread of #28240 · still open - [BUG] Bash cd-compound-read guard prompts on absolute cd targets whenever a Read() deny rule exists (Windows Git Bash, 2.1.257-2.1.259)
- …ing the 2.1.259 changelog entry added. One more note on the workaround: removing the deny rules is not something the agent can do for you when is in effect. Both the Bash edit and the Edit tool call on are refused by the…
Found in the thread of #91650 · still open - [BUG] [Claude in Chrome] All tools blocked on reddit.com (and redd.it) with "not allowed due to safety restrictions" since 2026-09-18 — worked through 2026-09-17
- A local reverse proxy works as a workaround, altering the host name. I've built [this]( to set up such reverse proxy fast for any hostname.
Found in the thread of #95326 · still open - Auto mode classifier (claude-opus-4-8) repeatedly unavailable — blocks Bash/Write/Edit
- …o in-product trace, which makes diagnosis needlessly hard). Workarounds that held up for us, for anyone affected (a) the remedy that actually worked: cold re-login of the Desktop app (logout → login) to rotate the broker…
Found in the thread of #63819 · still open - [BUG] Unnecessary "cd" prepended to Bash commands on Windows due to path format mismatch
- …ermission system matches the instead of the actual command. Workaround — PreToolUse hook to auto-approve cd-prefixed commands: includes a hook that handles this pattern while still blocking dangerous commands in the chai…
Found in the thread of #30524 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 201–300
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 551 matches; the statistics above cover all 551.
- VS Code extension ignores settings.json allow list and bypassPermissions for UNC network path file edits
- [BUG] Unauthorized git push to production
- [BUG] Deny rules in settings.json are not enforced — denied files and commands remain accessible`
- [BUG] "Allow Dangerously Skip Permissions" overrides plan mode in VS Code extension
- [BUG] Permission preview flickers / scroll snaps back when reviewing long Write or Edit tool-call content
- [BUG] --dangerously-skip-permissions does not bypass project-level "ask" rules in .claude/settings.json
- [BUG] Auto-mode classifier: session-level trust decay + hard-rail misattributed as user rejection (Windows, v2.1.138)
- [BUG] Claude Desktop on Windows: PowerShell tool call permission prompt delayed ~2m35s before appearing
- [BUG] - permissions.deny entries for Edit/Write are not enforced (Windows, v2.1.138)
- [DOCS] [additionalDirectories] Read/Edit tools denied on mapped network drives — fixed in v2.1.133
- [BUG] Toast notification Allow/Deny buttons are no-ops; permission must still be granted in Code. Very annoying.
- ExitPlanMode dialog buttons unresponsive (Clear-context-and-bypass / Proceed) + plan auto-executes in unrelated open terminal
- [BUG] Claude reads rules but don't follow it.
- [BUG] Enterprise managed settings (HKLM) are not applying
- [Bug] Dispatch repeatedly prompts for permission bypass despite account-level bypass rules configured
- Trust dialog repeats every launch on Windows 11 22H2 (OS-specific bug)
- [BUG] Bypass Permissions mode not supported when choosing to accept a plan
- [BUG] Write deny rules behave as ask — file creation is prompted instead of automatically blocked; also affects organization-managed settings
- [Bug] Auto-mode prevents basic function execution
- [BUG] Malformed settings.json files are silently skipped if they become incorrect after session startup.
- [Bug] Agents waste excessive token budget on permission checks without early validation
- UNC path check false-positive blocks WSL paths even with bypassPermissions
- [BUG] Prompt was 3X the size of my screen in claude desktop (code section).
- [BUG] Edit permission in settings.local.json not respected - confirmation dialog still appears
- [BUG] Desktop app UI freezes on permission prompt — Windows, requires force close
- [Bug] Permission allow rules not applied for Bash(mkdir) in skill contexts and default mode
- PreToolUse hooks: two Windows bugs — echo corrupts JSON, pre-approved permissions bypass hooks
- UX: 'auto mode is unavailable for your plan' message shown unnecessarily
- [BUG] IDE file-open events cancel pending tool permission prompts
- [BUG] Bash deny rules appear non-recursive for nested execution contexts ($(), backticks, subshell, eval, PowerShell wrapper)
- [BUG] allowedTools restrictions not enforced — Claude reads files without approval prompt
- [BUG] Security violation by design - leaking project details, memory on global scale
- [BUG] settings.local.json corrupted by improperly escaped Bash permission entries containing quotes inside regex patterns
- [Bug] Dangerous misinterpretation of file deletion request resulted in unintended --force-reset execution
- [BUG] Claude Code hangs after update on 28 feb 2026
- [BUG] CLAUDE.md rules ignored despite being loaded - Agent executes unauthorized actions
- [Bug] Desktop Code tab ignores project settings.json permissions.allow on Windows
- Headless (-p) sessions launched via Windows Task Scheduler deny already-allowlisted tool calls (Bash/PowerShell/Write/Edit); identical manual invocation never fails
- [BUG] Browser pane: the private-network read grant does not cover find, zoom, scroll, hover and read_console_messages, although the app files them as read requests
- [Bug] Bypass permissions mode overrides user tool preferences in CLAUDE.md and MCP tools
- Merge/push-to-main classifier blocks git push and gh pr merge even with full permissions.allow and Auto Mode configured
- [BUG] Desktop app on Windows: every new PowerShell tool call waits ~154 s before the command starts (dialog, permissions and host IPC ruled out); Bash is instant (same as #57960, closed stale; still present on 2.1.270)
- auto mode: environment setup pins an absolute trusted-repo path into user-global settings, so every other project inherits the wrong trust boundary
- Incorrect "impossible" judgment led to full disablement of production safety guards
- Cowork: mcp__workspace__bash and web_fetch denied in all sessions after desktop 1.44121.1 update (Windows)
- [BUG] VS Code extension drops Auto from the mode picker when user-settings model is an alias absent from the models list (e.g. "opus") — availability stuck at "unknown"
- Custom subagents fail to register after cold start when settings.local.json grows very large (348KB / 2438 valid permission entries) -- fixed by removing the file
- [BUG] Windows: per-project state splits into two entries when the cwd's drive-letter case differs (C:\ vs c:\)
- Claude Code bypassed a blocked system-path guard via 'cmd /c rd', then a destructive command silently continued unsupervised in the background after timeout — wiped C:\ drive root
- [BUG] Desktop Browser pane: a site on the "Allowed sites" list still raises a permission card on every tool call in Auto mode, claiming site permissions are disabled
- [BUG] "Don't ask again for similar commands" saves verbatim command strings, so near-identical commands re-prompt every time
- [BUG] Auto-memory Edit/Write to ~/.claude/projects/*/memory is gated as a sensitive file in project-cwd sessions; "always allow" doesn't persist (2.1.215)
- [BUG] Permission approval prompts never appear in the voice/text interface
- Desktop: Edit/Write/Agent instantly denied (~18-25 ms) even in bypassPermissions mode; grant state resets mid-session (v2.1.197, Windows)
- Permission prompt: key '1' = Approve in terminal CLI but Deny in Windows desktop app — muscle memory causes accidental denials
- [BUG] First launch with --permission-mode bypassPermissions leaves the workspace permanently untrusted (trust dialog never shown again)
- Windows: path-scoped Write/Edit permission rules never match — Write tool absolutizes file_path pre-check and absolute Windows paths match no documented pattern form
- Project-scope permission grant strips unknown top-level keys from .claude/settings.json
- [FEATURE]
- [BUG] Bypass Permissions warning silently persists acceptance forever — prompt says "while running in … mode" but the choice is permanent
- [DOCS] Permissions docs under-specify Windows path matching and Read deny behavior in Grep/Glob
- [BUG] Repo-level .claude/settings.json not loaded when session is rooted at a parent directory
- [BUG] Auto-mode permission levels don't compact context.
- Desktop launches CLI without --dangerously-skip-permissions despite defaultMode: bypassPermissions
- [DOCS] PowerShell docs omit workspace-boundary behavior for built-in `cd` forms
- [BUG] Claude wrote files to system temp folder (AppData\Local\Temp) without disclosure
- [Bug] Sub-agent `rm -rf` with case-insensitive path collision destroys workspace; no sandbox, confirmation, or orchestrator interception
- [BUG] AskUserQuestion permission stream closes before response - "Unhandled case: [object Object]" in VS Code extension
- Subagent Bash auto-approval regressed between runtime 2.1.121 and 2.1.128 under "Accept edits" mode
- Mobile app permission approval dismisses terminal prompt but chat doesn't continue
- Enhancement - auto appends
- [BUG] Code tab "Trust settings couldn't be saved" on Windows MSIX — saveTrust logs success but no config.json is created
- [BUG] Mobile permission approval lost on desktop: [bridge:repl] Failed to parse ingress message: undefined is not an object (evaluating 'H.rules.length') causes silent indefinite Bash hang
- [BUG] MCP tool result spuriously reports "user denied" without showing a permission prompt — affects mcp__codebrain__reindex_codebaseandmcp__codebrain__save_memory mid-session
- --dangerously-skip-permissions exits when an auto-edit prompt is declined, breaking Shift+Tab mode cycle
- bypassPermissions still prompts for Edit/Write on .py files in project-level settings
- [BUG] ask permission rules with path patterns don't override auto-allow for memory directory
- [Bug] Claude bypasses tool restrictions by using shell commands without disclosure
- Opus 4.6 stashed mid-implementation, then asked user permission to unstash its own work
- Permission walker unhandled node type `file_redirect` blocks allow-list for commands with redirects/pipes
- [BUG] When prompted for permission, #2 changes meaning between 1) Yes 2) Yes Always 3) No and 1) Yes 2) No
- [FEATURE] Cowork Dispatch: child task sessions should inherit parent's mounted directory
- Bug: anthropic-skills:docx hangs silently on Windows 11 (Write permission denied)
- Bash allow patterns fail to match compound commands, complex quoting, and long SSH commands
- Bash allow patterns fail to match compound commands, complex quoting, and long SSH commands
- MCP tool permissions require session focus in Desktop app, blocking long-running browser agents
- Bypass permissions mode silently downgrades to autoaccept-edits during session
- dangerously-skip-permissions blocks read-only file copy from ~/.claude/skills/ into workspace
- [BUG] additionalDirectories approved in one project leak into all projects via global settings (project contamination)
- [BUG] Shell redirect target saved as standalone permission entry in settings.local.json
- [BUG] plan mode on 存在缺陷，用户选择了plan mode on ，但是程序依然存在写入操作。
- [BUG] Permission mode resets to different mode when switching editor tabs via Ctrl+Tab / Ctrl+Shift+Tab
- [BUG] "Allow for all projects" permission not applied to pending MCP requests in same session
- Deny rules with absolute Windows paths do not block file access
- [BUG] sandbox.filesystem.allowWrite not enforced when using --dangerously-skip-permissions
- [BUG] Plan mode remains active after selecting 'Yes, clear context and auto-accept edits' (option 1)
- yes typed at permission prompt executes as background bash command, fills disk
- Document deny/allow rule precedence in settings.json permissions
- Model ignores explicit permission grants and continues prompting user for approval
- [BUG] fairly serious permissions problem : "cd*"