Security issues on Windows — page 3
Issues the maintainers labelled both platform:windows and area:security.
255 issues · 70 open · 185 resolved (73%) · first seen May 20, 2025
Is this getting better or worse?
This class of problem is still growing. 98 new reports in the last 90 days vs 77 in the 90 before — +27%. The open backlog peaked at 70 in 2026-08 and sits at 70 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
123 of these reports name the Claude Code build they were running, spanning 77 releases. Heaviest reporters:
- Claude Code v2.1.237
- Claude Code v2.1.205
- Claude Code v2.0.76
- Claude Code v2.1.226
- Claude Code v2.1.245
- Claude Code v2.1.233
- Claude Code v2.1.229
- Claude Code v2.1.206
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 38 days across 185 closures. Of the 185 closures with a recorded reason, 21% were closed as completed and 146 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
55 of these issues post a workaround someone says worked. The highest-engagement ones:
- bypassPermissions mode not working in VS Code extension
- issue was reproduced on after upgrade IDE-VSCODE-CC-01-v1: Workaround — bypassPermissions in VSCode Extension Linked rule: [IDE-VSCODE-CC-01-v1](IDE-VSCODE-CC-01-v1.md) Upstream: [anthropics/claude-code 20536]( --- Envir…
Found in the thread of #20536 · still open - [BUG] Permission to read and edit files for session not being respected
- …It was working fine before the update this afternoon. Note As a workaround I'm launching claude with the --dangerously-skip-permissions option. This works, however, I'm closely watching the console to ensure it hasn't g…
Found in the description of #7104 · resolved - [BUG] Claude Code will not do anything without manual authorisation every single step
- Thanks for reporting this bug, we're working on a fix. In the meantime, if you need to work around this issue, you can temporarily downgrade to v1.0.102 where this functionality is working correctly.
Found in the thread of #7161 · resolved - Bug Report: Path Patterns in allowedTools Not Honored in Non-Interactive Mode
- …laude Code's security model in automated contexts. The only workaround is to use simple tool permissions without path patterns: bashclaude config add allowedTools Write No path pattern Or specify permissions directly via…
Found in the description of #1188 · resolved - [BUG] Sub agents can't use tools properly: `Permission to use xxx has been auto-denied in dontAsk mode` even with `--dangerously-skip-permissions`
- Related to 11881, fix allegedly incoming. In the meantime seems like rolling back to 2.0.42 helps some users.
Found in the thread of #11934 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 201–255
Ranked by community engagement (reactions weighted over comments).
- [BUG] [SECURITY] OAuth session cached after logout — auto-approves login without credential prompt on shared machines
- [BUG] Cyber-safeguard block is returned as HTTP 400 invalid_request_error, not a model refusal — endpoint-layer, fires on benign ops across Opus 4.8 / 4.7 / Fable 5 (166 blocks in 11 days, request IDs included)
- [Bug] Security safeguard incorrectly flags user's own source code during audit
- [BUG] Cowork feature executed PowerShell that removed AMD display driver without user consent
- [BUG] `claude mcp get` prints full env values in plaintext (secret leak)
- [BUG] Claude Code create c:/memfs directory without asking me.
- [BUG] claude code auto run "reg.exe" inside the repo
- Model Circumvents Accountability Systems and Lies About Compliance
- [BUG] Foreign instruction text and fake context-limit notice injected into assistant message right after a bridge-session event
- Trust dialog on a chip's "Start with worktree" names the spawn_task cwd, not the worktree the session runs in
- [Bug] CTF Challenge Flagged as Suspicious - Legitimacy Verification Needed
- [BUG] Cowork mounted a folder into a project session that was never attached to that project, read-write
- [BUG] Desktop restart-continuation copies the full transcript into a new session file, and strands the old one (unbounded duplication when `cleanupPeriodDays` is raised)
- [Feature Request] Allow authorized security testing context in tool use filtering
- [Bug] Anthropic API Error: Overly aggressive cyber safeguard blocks legitimate anti-cheat development context
- [Bug] Prompt incorrectly flagged as '[cyber]' during local k8s security testing
- [BUG] Assistant fabricates synthetic `user` turns mid-session and keeps acting on them (58 occurrences / 9 sessions, with an exposure denominator)
- [Bug] False positive security flag for local-to-VM code transfer
- [BUG] Fabricated tool-call/tool-result blocks injected into conversation (VSCode extension)
- Bash permission deny patterns bypassed by a flag prefix before the subcommand (e.g. git -C <path> checkout -- <file>)
- [Bug] Anthropic API Error: Blocked by Security Policy for Legitimate Infrastructure Code
- [Bug] False positive cyber safeguard classification on authorized security audit skill
- [Feature Request] Add built-in security vulnerability scanning tool for local product validation
- [Bug] False positive security detection for API health check scripts with rate limit monitoring
- [BUG] Tool-call input contaminated with injected/flagged content, bypassing normal isolation (Windows, Claude Code)
- [Bug] Anthropic API [cyber] safeguard false positives on non-malicious messages in security project context
- [BUG] MCP server environment variable gets corrupted/redacted with bullet characters before reaching subprocess
- Unlogged message injected into model context impersonating a user interruption (social-engineering attempt)
- [MODEL] Assistant fabricated user turns mid-stream (mimicking UserPromptSubmit hook format) and executed tool calls on its own fabricated instructions — verified via queue-operation log forensics
- [Feature Request] Add security policy documentation and usage restrictions
- [BUG] policy-limits.json security restriction silently stripped, recurring within a single session
- Sub-agent ran recursive delete outside working dir, wiped entire user profile (~235k files); safety classifier failed open
- [Bug] False positive security flag on legitimate credential rotation workflow
- PreToolUse hook on `Edit|Write` is invoked and reaches a verdict, but its exit 2 is not enforced (Windows, agent-frontmatter and settings.json carriers)
- [Bug] Rate limiting or safety filters blocking legitimate security research workflows
- [Feature Request] Add security testing context exemption for internal vulnerability assessments
- Opus 4.8 fabricated attached-PDF content, embedding an unlabeled prompt-injection payload (fake exfil URL + concealment instruction)
- Hacking into build during code creation
- Fabricated user message with non-standard <system_warning><ctx_interruption> wrapper appeared in model context after Esc interruption; absent from session transcript
- are [Bug] Anthropic API Error: Safety measures blocked cybersecurity content processing
- `permissions.deny` path matching does not canonicalize Windows 8.3 short filenames, and wildcard deny patterns are not enforced consistently across tools (Read/Edit vs Glob)
- [BUG] Assistant text completes (end_turn, 20k output tokens) but is never rendered; ESC reveals silent verbatim recitation of the system prompt
- $BROWSER: OAuth URL wrapped in literal quotes; on Windows a .cmd target truncates it at `=` and executes `&` query fragments via cmd.exe
- [BUG] skipWorkflowUsageWarning is undocumented and agent-writable — an agent can disable its own spend guardrail
- Sub-agent (Task tool) returned hallucinated ccd_* MCP 'developer mode / trust escalation' server instructions as its result (0 tool calls)
- [BUG]
- [Bug] Anthropic API Error: Overly broad safeguard blocking legitimate security code reviews
- Tool-result stream injection: fabricated git output attempted to induce destructive git reset
- Background Opus subagents intermittently stall on first turn, leaking system-prompt fragments (incl. authorization-shaped text) as their only output
- [Feature Request] Model downgrade when safety guidelines flagged prevents access to higher reasoning tiers for safeguarding AI backed apps from prompt injection
- [Bug] False positive security flagging in debug mode for commerce systems
- Path-scoped --allowedTools 'Write(dir/**)' denies the first out-of-scope write but a retried out-of-scope write in the same session is not re-checked and succeeds (headless -p)
- [Feature Request] Support for shadow IT/AI detection tool integration
- Assistant output stream contaminated with stray synthetic data + fake system-reminder tag (persisted in assistant JSONL line); same-day phantom user message
- [BUG] Windows: remote-control trust check normalizes cwd to forward slashes but misses backslash keys in ~/.claude.json projects