Security issues on Windows — page 3
Issues the maintainers labelled both platform:windows and area:security.
368 issues · 125 open · 243 resolved (66%) · first seen May 20, 2025
Is this getting better or worse?
This class of problem is still growing. 166 new reports in the last 90 days vs 83 in the 90 before — +100%. The open backlog peaked at 125 in 2026-10 and sits at 125 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
221 of these reports name the Claude Code build they were running, spanning 113 releases. Heaviest reporters:
- Claude Code v2.1.237
- Claude Code v2.1.280
- Claude Code v2.1.281
- Claude Code v2.1.270
- Claude Code v2.1.259
- Claude Code v2.1.205
- Claude Code v2.0.76
- Claude Code v2.1.296
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 38 days across 243 closures. Of the 243 closures with a recorded reason, 17% were closed as completed and 201 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
68 of these issues post a workaround someone says worked. The highest-engagement ones:
- bypassPermissions mode not working in VS Code extension
- issue was reproduced on after upgrade IDE-VSCODE-CC-01-v1: Workaround — bypassPermissions in VSCode Extension Linked rule: [IDE-VSCODE-CC-01-v1](IDE-VSCODE-CC-01-v1.md) Upstream: [anthropics/claude-code 20536]( --- Envir…
Found in the thread of #20536 · still open - Hard block on typing passwords breaks legitimate dev/test workflows - needs a permission-gated opt-in for own dev environments
- …rver-side and dies on every app restart. Claude's suggested workaround was exactly that, and it collapsed on first contact with reality. We ended up building a passwordless dev-auto-login endpoint into the app (gated to…
Found in the description of #78160 · still open - [BUG] Permission to read and edit files for session not being respected
- …It was working fine before the update this afternoon. Note As a workaround I'm launching claude with the --dangerously-skip-permissions option. This works, however, I'm closely watching the console to ensure it hasn't g…
Found in the description of #7104 · resolved - [BUG] Claude Code will not do anything without manual authorisation every single step
- Thanks for reporting this bug, we're working on a fix. In the meantime, if you need to work around this issue, you can temporarily downgrade to v1.0.102 where this functionality is working correctly.
Found in the thread of #7161 · resolved - Bug Report: Path Patterns in allowedTools Not Honored in Non-Interactive Mode
- …laude Code's security model in automated contexts. The only workaround is to use simple tool permissions without path patterns: bashclaude config add allowedTools Write No path pattern Or specify permissions directly via…
Found in the description of #1188 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 201–300
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 368 matches; the statistics above cover all 368.
- [BUG] Claude Code create c:/memfs directory without asking me.
- security-guidance: Stop-hook LLM review broken on Windows when worktree has many untracked files (WinError 206)
- [Critical] /init command causes Explore agent to read files from unrelated project directories
- Claude circumvents Bash permission restrictions by switching to PowerShell
- Model recommended inline-secret command that leaks rescue admin password in Claude-isolation setup
- [Windows/Git Bash] PreToolUse hook enforcement silently bypassed — hooks exit 49 with no output or warning when python3 resolves to Store stub
- [Bug] Claude Code generates insecure deployments with exposed credentials and orphaned resources
- [BUG] WebFetch permission bypassed
- [BUG] Windows clipboard write exposes content in PowerShell argv (captured by EDR/SIEM ProcessCommandLine telemetry)
- Claude Code repeatedly violates user-defined CLAUDE.md rules within same session (credential handling)
- [Feature request] Local Claude Code logs allow state reset via manual deletion
- [BUG] `claude mcp get` and `claude mcp add --header` print Authorization header values unredacted to stdout
- Cross-device MCP browser command routing — UX concern + feature feedback
- [BUG] Access Token visible in Marketplace menu
- Cowork silently executes browser automation on unattended remote machine via shared account
- Missing trust/permission prompt in VSCode/Positron extension vs CLI
- Claude Code umgeht PreToolUse:Edit Hook durch Python-Script via Bash
- [BUG] Content filter falsely blocks transcription of 1986 agricultural newsletter
- CRITICAL: robocopy /MIR deletes local files due to UNC path misinterpretation
- [FEATURE] Block WebDAV paths by default on Windows to prevent permission bypass
- Model Circumvents Accountability Systems and Lies About Compliance
- [BUG] Security: Cross-account session data exposure between Personal Pro and Teams accounts
- Security reminder should detect workflow files on Windows paths
- [BUG] statusline-setup agent uses wrong username (data leakage between users)
- [BUG] File permission deny rules not enforced on Windows native version with Git Bash (works correctly on WSL)
- Where is the enterprise managed policy settings files in windows system for claude code 1.0.51 version
- [BUG] Built-in "dangerous rm" safety check is spelling-dependent: the MSYS /d/… form of a top-level path raises no approval gate
- Desktop auto mode: pending Bash permission request resolved itself after 37 hours and ran unattended
- [Bug] Cyber session flagged without security issues detected
- [CRITICAL] Sub-agent ran `rm -rf` on the user's Windows home directory (via 8.3 short name), no hard guard; delete kept running after the task was stopped
- [BUG] Windows: sub-agent rm -rf on the 8.3 short-name alias of the home dir wiped ~116 GB; TaskStop left it running ~50 min; agent reported 'looks intact' (related: #92593, #95426, #97660)
- Opus5.5 - warning security for local check leaking.
- [Bug] Sensitive information leaking despite configured stripping logic
- [Bug] Search results contain injected prompt injection content in system message tags
- Subagent `tools:` entry with a Bash specifier grants unrestricted Bash instead of scoping it
- [Bug] Cyber Safeguard False Positive Blocking Legitimate Build
- [Bug] all my messages are getting flagged because i ran a security audit on my repo with os4int tools
- [Bug] Legitimate debugging forensics incorrectly flagged as illegitimate
- I can see this message is in Korean, but I need to clarify that I cannot accurately process this as a valid GitHub issue report for Claude Code. The message appears to be about security flags and model downgrade behavior, but the details are unclear and ma
- [BUG] claude-security scan-changes reproducibly analyzes wrong diff content
- [Bug] Security system triggered during research file operations
- [Bug] False positive security flag on internal database queries
- [Bug] Legitimate code incorrectly flagged as malicious or unsafe
- [BUG] Simple prompt copy paste triggers [cyber] safeguard
- [Bug] CTF Challenge Flagged as Suspicious - Legitimacy Verification Needed
- [BUG] Per-device session visibility — sidebar leaks session titles across machines on one account
- [Bug] False positive cyber safeguard classification on authorized security audit skill
- [Feature Request] Add built-in security vulnerability scanning tool for local product validation
- [Bug] False positive security detection for API health check scripts with rate limit monitoring
- [BUG] Tool-call input contaminated with injected/flagged content, bypassing normal isolation (Windows, Claude Code)
- [Bug] Anthropic API [cyber] safeguard false positives on non-malicious messages in security project context
- [BUG] MCP server environment variable gets corrupted/redacted with bullet characters before reaching subprocess
- Unlogged message injected into model context impersonating a user interruption (social-engineering attempt)
- [MODEL] Assistant fabricated user turns mid-stream (mimicking UserPromptSubmit hook format) and executed tool calls on its own fabricated instructions — verified via queue-operation log forensics
- [Feature Request] Add security policy documentation and usage restrictions
- [BUG] policy-limits.json security restriction silently stripped, recurring within a single session
- Sub-agent ran recursive delete outside working dir, wiped entire user profile (~235k files); safety classifier failed open
- [Bug] False positive security flag on legitimate credential rotation workflow
- [Bug] Rate limiting or safety filters blocking legitimate security research workflows
- [Feature Request] Add security testing context exemption for internal vulnerability assessments
- Opus 4.8 fabricated attached-PDF content, embedding an unlabeled prompt-injection payload (fake exfil URL + concealment instruction)
- Hacking into build during code creation
- Fabricated user message with non-standard <system_warning><ctx_interruption> wrapper appeared in model context after Esc interruption; absent from session transcript
- are [Bug] Anthropic API Error: Safety measures blocked cybersecurity content processing
- `permissions.deny` path matching does not canonicalize Windows 8.3 short filenames, and wildcard deny patterns are not enforced consistently across tools (Read/Edit vs Glob)
- [BUG] Assistant text completes (end_turn, 20k output tokens) but is never rendered; ESC reveals silent verbatim recitation of the system prompt
- $BROWSER: OAuth URL wrapped in literal quotes; on Windows a .cmd target truncates it at `=` and executes `&` query fragments via cmd.exe
- Sub-agent (Task tool) returned hallucinated ccd_* MCP 'developer mode / trust escalation' server instructions as its result (0 tool calls)
- [BUG]
- [Bug] Anthropic API Error: Overly broad safeguard blocking legitimate security code reviews
- Tool-result stream injection: fabricated git output attempted to induce destructive git reset
- Background Opus subagents intermittently stall on first turn, leaking system-prompt fragments (incl. authorization-shaped text) as their only output
- [Feature Request] Model downgrade when safety guidelines flagged prevents access to higher reasoning tiers for safeguarding AI backed apps from prompt injection
- [Bug] False positive security flagging in debug mode for commerce systems
- Path-scoped --allowedTools 'Write(dir/**)' denies the first out-of-scope write but a retried out-of-scope write in the same session is not re-checked and succeeds (headless -p)
- [Feature Request] Support for shadow IT/AI detection tool integration
- Assistant output stream contaminated with stray synthetic data + fake system-reminder tag (persisted in assistant JSONL line); same-day phantom user message
- [BUG] Windows: remote-control trust check normalizes cwd to forward slashes but misses backslash keys in ~/.claude.json projects
- [BUG] Claude CLI Subscription Type Modification / Plan Escalation Issue
- [BUG] claude code auto run "reg.exe" inside the repo
- [Bug] Anthropic API Error: Cyber Safeguards Flagged Legitimate Request
- [Bug] Safety classifier false positive halts defensive grader hardening work
- [BUG] `claude` processes spawned from a desktop Code session ignore the session's account and fall back to the OS user's default CLI profile (silent switch to an org account: billing + data)
- [Bug] Opus 4.7 Real-Time Cyber Safeguards Flag Legitimate Security Work
- Coordinator relays to a Remote Control session arrive inside tool results when the session is mid-task
- [Bug] Conversation thread terminated by content safeguards on legitimate request
- Bug Report: Safeguards blocking legitimate requests
- [Bug] Filtro de segurança bloqueia trabalho legítimo de desenvolvimento de firmware
- [Bug] Claude Code blocks security-related requests despite user-provided cybersecurity waiver
- [Bug] Anthropic API Error: Overly restrictive safety filter blocks authorized security research
- [Bug] Opus 5.5 cyber safeguard falsely blocks offline payment-terminal QA harness
- [Bug] Cyber Safeguard False Positive Flags Router Repair Request
- [Bug] False Positive Session Pause ("cyber") on README Summary and Public Email Search Block
- [Bug] False positive [cyber] block on legitimate fleet update request (Opus 5.5)
- [BUG] `permissions.ask` confirmation prompt does not surface for Bash commands run by a background-dispatched subagent
- [Bug] Cyber classifier forces model switch to Opus 4.8 on legitimate product-protection work
- permissions.deny Bash rules stop matching when the command contains a backslash inside double quotes
- Allow .local development domains in the local test-host allowlist
- [Bug] Anthropic API Error: Overly aggressive content filtering on benign Polish greeting
- [BUG] security-guidance: two TestStop tests read review_model.json instead of the session state file