Permission deny rules not enforced for Bash commands

[jharshman]

Bug Description

Claude Code is not respecting the deny rules configured in .claude/settings.json for Bash commands.

Steps to Reproduce

1. Configure .claude/settings.json with a deny rule for gcloud:

{
  "permissions": {
    "deny": [
      "Bash(*gcloud*)"
    ]
  }
}

2. Ask Claude to run a gcloud command (e.g., run gcloud -h or gcloud)
3. Claude executes the command despite it being in the deny list

Expected Behavior

Commands matching patterns in the deny list should be blocked and never execute, regardless of other settings like dangerouslyDisableSandbox.

Actual Behavior

Claude successfully executed gcloud -h and gcloud commands even though Bash(*gcloud*) is explicitly denied in settings.json.

Configuration

{
  "defaultMode": "dontAsk",
  "permissions": {
    "allow": [...],
    "deny": [
      "Bash(*kubectl*)",
      "Bash(*terraform*)",
      "Bash(*aws*)",
      "Bash(*gcloud*)",
      "Bash(*sudo*)",
      "Bash(*rm*)",
      ...
    ],
    "ask": [...]
  },
  "sandbox": {
    "enabled": false,
    "autoAllowBashIfSandboxed": false,
    "allowUnsandboxedCommands": false
  },
  "disableBypassPermissionsMode": "enforce"
}

Impact

This is a security issue as it allows bypassing user-configured safety restrictions for dangerous commands like kubectl, terraform, aws, gcloud, sudo, rm, etc.

Environment

• Claude Code version: [unknown from session]
• Platform: macOS (Darwin 25.1.0)
• Model: claude-sonnet-4-5-20250929

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] Bash permission blocking system not enforcing configured restrictions #24832
2. [BUG] Bash permissions in settings.json not enforced - requires custom hook workaround #18846
3. Claude Code ignores deny rules in .claude/settings.local.json - security vulnerability #8961

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[github-actions]

This issue has been automatically closed as a duplicate of #24832.

If this is incorrect, please re-open this issue or create a new one.

🤖 Generated with Claude Code

[jharshman]

Can I get this reopened?

[jharshman]

Nevermind. opened a new issue.
#26334

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.