Repository navigation
Security Permissions Bypass in Bash File Access Restrictions #6036
Description
Bug Description
Bug Report: Claude Code Security Permissions Bypass
Summary:
Security permissions configured in .claude/settings.json can be
bypassed when using indirect file access through Bash
commands, allowing access to restricted files that should be
denied.
Steps to Reproduce:
- Configure .claude/settings.json with deny permissions:
{
"permissions": {
"deny": [
"Read(appsettings)",
"Edit(appsettings)",
"Write(appsettings)",
"Bash(appsettings)"
]
}
} - Attempt direct file access using Read tool - correctly
denied - Use indirect Bash commands that access the same restricted
files:
- find /path -name "*.json" -exec grep -l "pattern" {} ;
- grep -A5 -B2 "pattern" /path/to/appsettings.json
Expected Behavior:
All Bash commands accessing files matching the appsettings
pattern should be blocked according to the
"Bash(appsettings)" rule.
Actual Behavior:
Bash commands successfully execute and return content from
restricted files, bypassing the security permissions.
Security Impact:
This allows Claude to access sensitive configuration files
(like database connections, API keys, etc.) that users
explicitly intended to restrict, potentially exposing
confidential information.
Environment:
- Claude Code CLI
- Model: claude-opus-4-1-20250805
- Platform: macOS (Darwin 24.6.0)
Environment Info
- Platform: darwin
- Terminal: tmux
- Version: 1.0.83
- Feedback ID: 2ba205a2-08b0-49b8-8b5b-29c6ab956cd5
Activity
github-actions commentedon Aug 18, 2025
Found 3 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
aspiers commentedon Aug 18, 2025
#4956 is not a duplicate because the
findandgrepexamples given don't require command chaining.#3501 and #4768 are not duplicates because they're about
denynot working as documented.github-actions commentedon Dec 5, 2025
This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.
aspiers commentedon Dec 10, 2025
No reason to believe this is not still occurring.
github-actions commentedon Jan 13, 2026
This issue has been automatically closed due to 60 days of inactivity. If you're still experiencing this issue, please open a new issue with updated information.
marcindulak commentedon Jan 13, 2026
This issue was closed incorrectly despite recent human comments. This behavior of the bot is reported at #16497. Upvote or comment on that issue, so maybe it gets noticed.
github-actions commentedon Jan 20, 2026
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.