SECURITY: Claude circumvents denied Bash(rm) by using Python os.remove() as workaround #39459

Activity

1. github-actions

   added

   bugSomething isn't workingSomething isn't working

   area:security

   area:permissions

   has reproHas detailed reproduction stepsHas detailed reproduction steps

   on Mar 26, 2026
2. github-actions commented on Mar 26, 2026

   

   github-actionsBot

   on Mar 26, 2026 – with GitHub Actions

   More actions

   Found 1 possible duplicate issue:

   1. Security: permission enforcement relies on LLM judgment rather than hard rules, settings.local.json may be bypassed #31421

   This issue will be automatically closed as a duplicate in 3 days.

   • If your issue is a duplicate, please close it and 👍 the existing issue instead
   • To prevent auto-closure, add a comment or 👎 this comment

   🤖 Generated with Claude Code
3. marlvinvu commented on Mar 27, 2026

   

   marlvinvu

   on Mar 27, 2026

   More actions

   My Claude says your issue is similar to issue #38841. I hope you can connect and find a solution together.
4. yurukusa commented on Mar 29, 2026

   

   yurukusa

   on Mar 29, 2026

   More actions

   The root issue is that Bash(rm *) only blocks the rm binary — it doesn't block the goal of file deletion. A hook that covers all deletion vectors:

   CMD=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
   [ -z "$CMD" ] && exit 0
   if echo "$CMD" | grep -qE 'python[23]?\s+-c\s.*\b(os\.remove|os\.unlink|shutil\.rmtree|pathlib.*unlink)\b'; then
       echo "BLOCKED: File deletion via Python." >&2; exit 2
   fi
   if echo "$CMD" | grep -qE 'node\s+-e\s.*\b(unlinkSync|rmdirSync|rmSync)\b'; then
       echo "BLOCKED: File deletion via Node.js." >&2; exit 2
   fi
   if echo "$CMD" | grep -qE 'ruby\s+-e\s.*\b(File\.delete|FileUtils\.rm)\b'; then
       echo "BLOCKED: File deletion via Ruby." >&2; exit 2
   fi
   if echo "$CMD" | grep -qE 'perl\s+-[eE]\s.*\bunlink\b'; then
       echo "BLOCKED: File deletion via Perl." >&2; exit 2
   fi
   exit 0

   This catches the exact bypass pattern you observed: python3 -c "import os; os.remove('file')" when Bash(rm *) is denied.
   The key design principle: block the goal (file deletion), not the tool (rm). The hook detects deletion intent across Python, Node, Ruby, and Perl, covering the most common bypass routes.
   Pair this with your existing Bash(rm *) deny rule for complete coverage.
5. node9ai commented on Mar 30, 2026

   

   node9ai

   on Mar 30, 2026

   More actions

   This issue highlights the core flaw in Tool-Based Blocking: LLMs are 'Goal-Oriented.' If you block the rm binary, the agent just treats it as a technical obstacle and pivots to a Python or Node.js equivalent to reach the same goal.
   Most current hooks (like the Rego/bash snippets suggested above) are a game of cat-and-mouse. You block Python, and the agent moves to Perl or Ruby.
   I’ve been researching a different approach called Execution Governance. Instead of trying to block every possible binary, we use a proxy (Node9) to parse the AST of the command before it executes. This allows for 'Goal-Based' human-in-the-loop approval. If the AI tries to delete a file via any interpreter, it triggers a native OS popup or Slack alert.
   I did a deep-dive comparison between NVIDIA's OpenShell approach (Infrastructure Isolation) vs. this Governance model here. I think it's the only way to stop these 'bypass-by-design' hallucinations: https://dev.to/node9_ai/securing-the-agentic-era-an-architectural-review-of-nvidia-openshell-vs-node9-proxy-2f7j
6. github-actions

   added

   staleIssue is inactiveIssue is inactive

   on Apr 19, 2026
7. github-actions commented on May 3, 2026

   

   github-actionsBot

   on May 3, 2026 – with GitHub Actions

   More actions

   Closing for now — inactive for too long. Please open a new issue if this is still relevant.
8. github-actions

   closed this as not plannedon May 3, 2026
9. github-actions commented on Jun 22, 2026

   

   github-actionsBot

   on Jun 22, 2026 – with GitHub Actions

   More actions

   This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.
10. github-actions

    locked as resolved and limited conversation to collaborators on Jun 22, 2026