Security issues on Windows — page 2
Issues the maintainers labelled both platform:windows and area:security.
368 issues · 125 open · 243 resolved (66%) · first seen May 20, 2025
Is this getting better or worse?
This class of problem is still growing. 166 new reports in the last 90 days vs 83 in the 90 before — +100%. The open backlog peaked at 125 in 2026-10 and sits at 125 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
221 of these reports name the Claude Code build they were running, spanning 113 releases. Heaviest reporters:
- Claude Code v2.1.237
- Claude Code v2.1.280
- Claude Code v2.1.281
- Claude Code v2.1.270
- Claude Code v2.1.259
- Claude Code v2.1.205
- Claude Code v2.0.76
- Claude Code v2.1.296
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 38 days across 243 closures. Of the 243 closures with a recorded reason, 17% were closed as completed and 201 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
68 of these issues post a workaround someone says worked. The highest-engagement ones:
- bypassPermissions mode not working in VS Code extension
- issue was reproduced on after upgrade IDE-VSCODE-CC-01-v1: Workaround — bypassPermissions in VSCode Extension Linked rule: [IDE-VSCODE-CC-01-v1](IDE-VSCODE-CC-01-v1.md) Upstream: [anthropics/claude-code 20536]( --- Envir…
Found in the thread of #20536 · still open - Hard block on typing passwords breaks legitimate dev/test workflows - needs a permission-gated opt-in for own dev environments
- …rver-side and dies on every app restart. Claude's suggested workaround was exactly that, and it collapsed on first contact with reality. We ended up building a passwordless dev-auto-login endpoint into the app (gated to…
Found in the description of #78160 · still open - [BUG] Permission to read and edit files for session not being respected
- …It was working fine before the update this afternoon. Note As a workaround I'm launching claude with the --dangerously-skip-permissions option. This works, however, I'm closely watching the console to ensure it hasn't g…
Found in the description of #7104 · resolved - [BUG] Claude Code will not do anything without manual authorisation every single step
- Thanks for reporting this bug, we're working on a fix. In the meantime, if you need to work around this issue, you can temporarily downgrade to v1.0.102 where this functionality is working correctly.
Found in the thread of #7161 · resolved - Bug Report: Path Patterns in allowedTools Not Honored in Non-Interactive Mode
- …laude Code's security model in automated contexts. The only workaround is to use simple tool permissions without path patterns: bashclaude config add allowedTools Write No path pattern Or specify permissions directly via…
Found in the description of #1188 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–200
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 368 matches; the statistics above cover all 368.
- [Bug] Anthropic API Error: False positive safeguard flags on claude-opus-5-5 with reasoning_extraction
- [Bug] Cybersecurity Filter False Positive Detection
- [Bug] Security vulnerability: Private repository data exposed to production without filtering
- [BUG] skipWorkflowUsageWarning is undocumented and agent-writable — an agent can disable its own spend guardrail
- [FEATURE] Claude in Chrome: connected browser can be driven cross-machine with no reliable device identification
- Subagent replies delivered to the wrong session when multiple sessions run agents concurrently (Windows)
- [BUG] Remote Control SSE channel (worker/events/stream) ignores NODE_EXTRA_CA_CERTS while the API channel honors it — same process, v2.1.201 (it's Node, not Bun)
- [BUG] OAuth login/refresh fails with UNABLE_TO_GET_ISSUER_CERT on platform.claude.com's new Let's Encrypt (ISRG Root X2 cross-signed) chain
- [BUG][SECURITY] Tool results appear to be modified after execution with injected pseudo-"system instructions" repeatedly urging destructive `git push --force` (Cowork research preview, Windows)
- [BUG] Deny rules in settings.json are not enforced — denied files and commands remain accessible`
- Hook path with spaces in username executes wrong file on Windows — unquoted ~ expansion splits path at space
- `claude mcp remove` expands `${VAR}` env-var references inline in `.mcp.json`, leaking secrets
- Claude misidentifies legitimate system reminder as prompt-injection attack hosted on fetched URL
- # Malformed flag `-dangerously-skip-permissions` (single dash) silently enables `--debug` via prefix match
- [BUG] Malformed settings.json files are silently skipped if they become incorrect after session startup.
- [BUG] Claude Code builds CAPTCHA solver and tests against live system without user consent
- [BUG] Explore agent triggers unscoped file access, causing OneDrive to download cloud-only files
- [BUG] Security violation by design - leaking project details, memory on global scale
- [BUG] Data loss caused by Claude Code — unauthorized destructive command
- [BUG]
- Feature Request: Native GUI Password Prompt for Sudo Commands
- [BUG] MCP OAuth: state parameter not sent in authorize request but validated on callback
- Opus Model : Antivirus detected as misbehavior
- [BUG] Workspace Trust Dialog Not Respecting Pre-configured ~/.claude/.claude.json
- [Bug] Dangerous rm Command Execution with Unintended Path Parsing
- Permissions Validation Override Not Working in Plan Mode
- Filesystem MCP access limited to WSL directories - need full computer access
- Windows Permission Persistence Failure During CLI Startup
- [BUG] Model fabricates user turns in its own response and acts on them (14x in one session)
- [Bug] Anthropic API Error: Message flagged by safeguards despite Cyber Verification Program enrollment
- Prohibited-actions rule blocks user-authorized local VPN login script (OTP supplied by user, secret never leaves the device)
- [Bug] Anthropic API Error: Sonnet 5 Cyber Safeguards Blocking Legitimate Code Review
- [Bug] False positive safety flag on cybersecurity website design tasks
- Suspected prompt injection in background subagent tool-result stream (Bash), instructing agent to conceal file state from user
- Claude Code bypassed a blocked system-path guard via 'cmd /c rd', then a destructive command silently continued unsupervised in the background after timeout — wiped C:\ drive root
- claude mcp add --header exposes Authorization/Bearer token value in stdout
- PowerShell safety guard false positive: here-string body text with paths like /requirements.txt blocked as 'Remove-Item on system path'
- [BUG] Scheduled task creation fails on Windows with UNC-redirected Documents folder
- [BUG] SECURITY RISK FORCING USERS FOLDER FOR .CLAUDE
- [BUG] Repo-level .claude/settings.json not loaded when session is rooted at a parent directory
- [BUG] Safety classifier false positives block benign questions in security-context sessions
- Secret leak: agents read .env / credential files without redaction; remediation pushed onto user
- Enhancement - auto appends
- UserPromptSubmit hook: decision: "block" does not erase typed prompt from model context
- [BUG] SECURITY: claude-in-chrome MCP controls browsers across different Claude accounts (extends #33813)
- Conversation history leak via FileChanged notifications bypasses guard hooks and gitignore
- [BUG]
- [BUG] Calude Code (VSCode extension) not honoring .claudeignore file, and not catching that it should have, causing too much token consumption
- [BUG] Claude Code (Windows) fails under enterprise SSL inspection — ignores system & custom CA trust
- Default to private when creating GitHub repositories
- Playwright MCP silently hijacks all Chrome downloads to temp folder
- remote-control rejects workspace trust set in .claude.json on Windows
- [BUG] Suspicious tip/hint displayed during active tool use suggesting fake plugin install command
- [BUG] PreToolUse hooks exit code ignored - operations proceed after hook failure
- C:/Program Files/Git/clear command does not clear terminal scrollback - previous session data remains visible
- [BUG] <system-reminder> can read sensitive selected text from .env files, no hooks available to protect our files
- [DOCS] Missing configuration example for Windows WebDAV security warning
- Claude Code executed forbidden rollback command and repeatedly violated explicit safety instructions despite CLAUDE.md prohibitions
- Windows: libsafewoo DLL deleted by Chinese antivirus software (360, Huorong)
- security-guidance plugin fails on Windows: python3 command not found
- [BUG] IP from someone else and not from my conversation
- [BUG] Approval patterns with environment variables don't match
- Issue Report: Claude Code Used Unknown IP Address
- [BUG] security-guidance plugin hook fails on Windows paths with spaces Body
- [Bug] Code execution occurring mid-response before user confirmation
- [BUG] Windows Claude Code versions after 2.0.24 signed with expired certificate
- [BUG] MCP Permission Bypass Regression - Post-Outage Issue Affecting Multiple Accounts
- "MongoDB Maintenance Operations Blocked - Critical Policy Issue"
- [Bug] HTML Artifact Causes Desktop Application Renderer Instability
- [Bug] Unauthorized Code Commit Without User Approval
- [Bug] Anthropic API Error: Unexpected False Positive AUP Violation
- [BUG]
- [BUG] Unauthorizied Directory Traversal
- [BUG] Permission deny patterns not working for Read/Write tools in settings.local.json
- security-guidance: git status -uall walks every submodule, ~73s per call in a 66-submodule repo
- [BUG] Subagent ran rm -rf \ via PowerShell → MSYS2 bash (PowerShell expanded the escaped variables to empty), wiping C:\ top-down on Windows
- [Bug] Anthropic API Error: Sonnet 5 Cyber Safeguards Blocking Legitimate Code Analysis
- Desktop app: input typed into a Windows session executes in an unrelated macOS session (cross-machine session mix-up)
- Trust dialog on a chip's "Start with worktree" names the spawn_task cwd, not the worktree the session runs in
- Trusted Devices fails open on individual accounts: revoking devices doesn't re-verify an active session, and declining "Sign in again to verify your device" has no effect either
- [BUG] Desktop GUI session delete removes only the registry entry — plaintext transcript remains on disk (indefinitely if `cleanupPeriodDays` is raised)
- [edit] I'm dumb and was melodramatic.
- [BUG] Claude in Chrome side panel shows "refused to connect" — claude.ai/a.claude.ai frames blocked by CSP frame-ancestors missing the extension origin
- [Bug] Log4Shell probe string in file content triggers connection reset instead of safeguard message
- PreToolUse hook on `Edit|Write` is invoked and reaches a verdict, but its exit 2 is not enforced (Windows, agent-frontmatter and settings.json carriers)
- [Bug] Context leakage between unrelated projects across sessions
- Agent tool: isolation:"worktree" subagent read parent session's private transcript outside its worktree
- Native Windows: working directory does not scope shell-tool filesystem access
- [MODEL] Opus 4.8 fabricated user messages 6+ times in one long session and "answered" them; cyber safeguard then blocked the user's request to audit the transcript
- [BUG] No path-level exclusion for sensitive files in file-change-notification behavior
- [Bug] Security scan incorrectly flags user's own source code as suspicious
- Security: undeclared HTTP MCP transport persisted with credentials in global .credentials.json, presented as a project MCP, survives config removal
- [BUG] my /remote-control session got poisend with malicious prompt injections
- [Feature Request] Blue team exercise context to suppress false positive alerts
- [BUG] [SECURITY] OAuth session cached after logout — auto-approves login without credential prompt on shared machines
- [BUG] Cyber-safeguard block is returned as HTTP 400 invalid_request_error, not a model refusal — endpoint-layer, fires on benign ops across Opus 4.8 / 4.7 / Fable 5 (166 blocks in 11 days, request IDs included)
- [Bug] Security safeguard incorrectly flags user's own source code during audit
- [BUG] Cowork feature executed PowerShell that removed AMD display driver without user consent
- [BUG] `claude mcp get` prints full env values in plaintext (secret leak)
- `claude mcp add` echoes Authorization header value verbatim to stdout, leaks bearer tokens to terminal and session transcripts