Security issues on Windows
Issues the maintainers labelled both platform:windows and area:security.
368 issues · 125 open · 243 resolved (66%) · first seen May 20, 2025
Is this getting better or worse?
This class of problem is still growing. 166 new reports in the last 90 days vs 83 in the 90 before — +100%. The open backlog peaked at 125 in 2026-10 and sits at 125 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
221 of these reports name the Claude Code build they were running, spanning 113 releases. Heaviest reporters:
- Claude Code v2.1.237
- Claude Code v2.1.280
- Claude Code v2.1.281
- Claude Code v2.1.270
- Claude Code v2.1.259
- Claude Code v2.1.205
- Claude Code v2.0.76
- Claude Code v2.1.296
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 38 days across 243 closures. Of the 243 closures with a recorded reason, 17% were closed as completed and 201 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
68 of these issues post a workaround someone says worked. The highest-engagement ones:
- bypassPermissions mode not working in VS Code extension
- issue was reproduced on after upgrade IDE-VSCODE-CC-01-v1: Workaround — bypassPermissions in VSCode Extension Linked rule: [IDE-VSCODE-CC-01-v1](IDE-VSCODE-CC-01-v1.md) Upstream: [anthropics/claude-code 20536]( --- Envir…
Found in the thread of #20536 · still open - Hard block on typing passwords breaks legitimate dev/test workflows - needs a permission-gated opt-in for own dev environments
- …rver-side and dies on every app restart. Claude's suggested workaround was exactly that, and it collapsed on first contact with reality. We ended up building a passwordless dev-auto-login endpoint into the app (gated to…
Found in the description of #78160 · still open - [BUG] Permission to read and edit files for session not being respected
- …It was working fine before the update this afternoon. Note As a workaround I'm launching claude with the --dangerously-skip-permissions option. This works, however, I'm closely watching the console to ensure it hasn't g…
Found in the description of #7104 · resolved - [BUG] Claude Code will not do anything without manual authorisation every single step
- Thanks for reporting this bug, we're working on a fix. In the meantime, if you need to work around this issue, you can temporarily downgrade to v1.0.102 where this functionality is working correctly.
Found in the thread of #7161 · resolved - Bug Report: Path Patterns in allowedTools Not Honored in Non-Interactive Mode
- …laude Code's security model in automated contexts. The only workaround is to use simple tool permissions without path patterns: bashclaude config add allowedTools Write No path pattern Or specify permissions directly via…
Found in the description of #1188 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–100
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 368 matches; the statistics above cover all 368.
- bypassPermissions mode not working in VS Code extension
- Hard block on typing passwords breaks legitimate dev/test workflows - needs a permission-gated opt-in for own dev environments
- [BUG] Claude on native Windows repeatedly asks to trust folder
- [BUG] Permission to read and edit files for session not being respected
- [Feature Request] Native sandbox support for Windows (non-WSL)
- [BUG] Claude Code will not do anything without manual authorisation every single step
- Bug Report: Path Patterns in allowedTools Not Honored in Non-Interactive Mode
- [BUG] Sub agents can't use tools properly: `Permission to use xxx has been auto-denied in dontAsk mode` even with `--dangerously-skip-permissions`
- [BUG] Cowork Windows - CSP blocks a-api.anthropic.com, VM starts but API unreachable (Win 11 25H2)
- [BUG] Local MCP server will not trust self-signed certs
- Agent deleted 2,229 untracked source files without explicit user instruction — catastrophic unrecoverable data loss
- [BUG] OpenTelemetry telemetry cannot be disabled on Windows - outputs personal data every 30 seconds
- [BUG] ralph-wiggum stop hook triggered in separate session
- [BUG] .claudeignore does not prevent Claude from reading ignored files
- [BUG] NODE_EXTRA_CA_CERTS is not effective when set in ~/.claude/settings.json
- [BUG]
- Anthropic API Policy Violation Detection Incorrectly Blocking All User Inputs
- Claude Code exposes secrets from .env / .dev.vars files via grep -n and Read tool, despite CLAUDE.md prohibitions
- [BUG] Asking permission too often
- Authorized bounty/CTF security research blocked mid-session — need context-aware handling for whitehat workflows
- [BUG] Permission approval UI not displayed - operations immediately rejected without user interaction
- [BUG] All naver.com domains blocked by default safety restrictions — false positive on Korea's primary portal (daum.net / tistory.com not blocked)
- [BUG] DeprecationWarning: DEP0190 in Claude CLI due to shell: true usage
- [BUG] Claude code is NOT following strict instuctions inside of Claude.md
- [BUG] Claude Code `-EncodedCommand` PowerShell Execution Blocked by EDR/AV — No Opt-Out Available
- Phantom user turn carried a context-aware prompt-injection / data-exfiltration payload (Windows, CLI 2.1.160, Opus 4.8)
- [FEATURE] Local password lock for Claude Code conversations (like Telegram)
- PreToolUse hooks and --allowedTools not enforced in headless -p mode
- Documentation update for security. Claude overrides rules but this is not obvious and only reveals it after pain. Update documentation giving abstraction solution PLEASE
- Support Microsoft MXC sandboxing
- Desktop Browser pane: allow user-approved local hostnames (hosts-file aliases) as trusted preview origins — currently all subresources blocked with ERR_BLOCKED_BY_CLIENT
- [BUG] 2.1.193 VS Code extension (Windows, native): OAuth login fails "certificate has expired" — regression from 2.1.190
- Claude Desktop Code tab ignores NODE_EXTRA_CA_CERTS on Windows MSIX install behind corporate SSL proxy
- [BUG] IDE extension bypasses .claudeignore and settings.json deny rules (Auto-attach context leak)
- Own code, market as Malware and refuses to make edits, after an hour I still worked what is happening?
- [BUG] Bash tool bypasses settings.json path deny rules — shell commands not subject to file tool access controls
- [BUG] LOST DB INFORMATION DUE TO CLAUDE NOT ASKING PERMISSIONS
- [Bug] Opus 5.5 incorrectly downgrading CVP-verified users on false-positive cyber classification
- [BUG] security-guidance plugin: `_glob_match` docstring says `**` matches any depth, but fnmatch implementation silently excludes top-level files from security rules
- Security: permission enforcement relies on LLM judgment rather than hard rules, settings.local.json may be bypassed
- [BUG] # Claude Code v1.0.103 Critical Bug Report
- [Bug] Security Vulnerability: Permissions Bypass via ExitPlanMode Workflow Exploit
- [BUG] Unacceptable File Access
- [BUG] AUP repeatedly throwing false positives - live issue ongoing - hundreds of similar reports
- system-reminder nudges ("NEVER mention this reminder to the user") are indistinguishable from prompt-injection attacks and cause false positives
- [Bug] Update 1.1.7714 broke Claude Code desktop app — ccd-cli passes --allow-dangerously-skip-permissions as root + Hyper-V not initializing on Windows
- [BUG] Windows: Drive Letter Change Triggers Permission Resolver Explosion + Arbitrary .claude/ Directory Creation Outside Workspace
- [BUG] I was asking Claude Code to review my privacy settings, and this was one of the searches it did. I believe this user is one of the Claude Code devs.
- [BUG] Phantom user messages - commands executed without user input
- Permission System Bypass: Unauthorized .env File Access
- Edit tool applied changes without a permission prompt despite `ask` rules for Edit (Windows, 2.1.278)
- `.claude.json` stores one project directory under up to three different path spellings, splitting trust, MCP servers, and worktree state across them
- [BUG] Spoofed/fabricated tool results injected into the session[Opus 4.8]
- [BUG] Subagent autonomously ran destructive DELETE scripts against production data
- [BUG] Claude Code permission bypass using @../ attachment syntax outside workspace boundary
- [BUG] Desktop: misbehaving DXT can spam unblockable file-attach consent dialog with no UI escape
- Path-pattern scanner false-positives on Windows 8.3 short names (e.g. ALICEM~1), bypassing user allow-rules — affects users with non-ASCII chars in their Windows username
- enableAllProjectMcpServers should default to false for security
- Require user consent before auto downloading update installers
- [BUG] SELF_SIGNED_CERT_IN_CHAIN Error: Extension Fails in Corporate Proxy Environment (Zscaler)
- [BUG] AI agent violates explicit "NO COMMITS without approval" rule in CLAUDE.md
- grep -r and cp -r still bypass Read() deny rules on 2.1.259 (changelog fix does not reproduce; Windows/VS Code extension)
- dangerouslyDisableSandbox allows the model to bypass workspace boundaries without a distinct, explicit user confirmation
- Plugin safety: third-party plugins can silently disable auto_memory via env vars
- [BUG] No permission prompt before reading/searching files OUTSIDE the working directory
- [FEATURE] Allowlist-only file access + deny rules for MCP tools (WebFetch, WebSearch)
- [BUG] IDE selection state persists across file close + new CLI session — closed file's selection re-appears in subsequent context
- Unexpected message injection — text from WhatsApp appeared in Claude Code session
- [BUG] claude should not be allowed to start claude. (Denial of service vulnerability: exploit with prompt: "sessions")
- [Bug] Unsafe directory traversal attempt during /init - attempted parent directory access
- [DOCS] PowerShell tool docs omit dangerous-command safety behavior
- [BUG] Explore subagent should request permission before fetching web content (prompt injection risk)
- [BUG] `disallowedTools: [Write, Edit]` trivially bypassed via Bash tool — agents use sed/awk/redirects to modify files
- [BUG] Cross-session credential leak in conversation summary (context continuation)
- Bug: Claude executes destructive git checkout without confirmation
- security-guidance plugin fails on Windows - uses python3 instead of python
- [BUG] Claude's PowerShell workaround for Edit tool failures caused file corruption and data loss
- [BUG] Claude deleting files without requesting permission
- Security hook blocks legitimate mentions in documentation files
- [Feature Request] Prevent Unintended Database Destruction via Confirmation Prompt
- [BUG] EDITED: Claude Code fails on mobile networks due to IP-based connections instead of hostname-based HTTPS
- Claude Code deleted ~600GB: unprompted `rm -rf` on a substitution that resolved to a drive root
- Native Windows: working directory does not scope shell-tool filesystem access
- [BUG] /feedback sends Git repository + SSH commands with customer personal data
- Granular control over <system-reminder> injections (env var / settings)
- [BUG] Managed hooks restriction bypassed when using ANTHROPIC_BASE_URL
- [BUG] Cowork: Agent autonomously explores filesystem outside sandbox boundary (Windows 11)
- [BUG] `--allowedTools` has no effect when permission bypass flags are active
- [BUG] Claude Code executed rm -rf /* on production VPS due to SSH variable escaping error
- [BUG] rm -rf with unexpanded ${LOCALAPPDATA} in bypassPermissions deletes real system directory
- [BUG] .claudeignore deny list bypassed by Agent tool sub-process — blocked *.json files were read and modified
- [BUG] Claude Code ran destructive prisma db push against production database, causing complete data loss
- Claude Code accessing files outside workspace directory (triggering Dropbox downloads)
- [BUG] Project-level allow rules cannot override user-level deny rules for path patterns
- [Bug] Critical Security Vulnerability in Claude Code
- [BUG] Claude Code randomly nukes claude.json in wsl
- [BUG] Claude Projects: every cloud thread is server-side bound to the desktop device (config:claude-code-device-bind), which blocks egress writes and Google OAuth refresh; only fix ("Require trusted devices") disables project Remote Control
- [Bug] Safeguard Restrictions Blocking Legitimate Commercial Project Development
- User-level hooks are skipped in untrusted workspaces; they should run regardless of trust
- Windows: Bash tool silently truncates the wrapped command at 8,186 chars, so commands don't run, run partly, or dump the environment