Claude Code Reverts Windows Symlink and Redirection Permission Checks

Claude CodeAug 14, 2026View original changelog

Anthropic rolled back part of a permission-check hardening fix it had shipped just one day earlier in Claude Code 2.1.232. That fix required explicit approval before Bash commands wrote through Cygwin-style symlinks on Windows, and before input redirections like < file were used, closing a path-validation gap where Git Bash treated symlinks as ordinary files. The rollback followed reports that the same change made auto mode repeatedly stop for manual approval on ordinary commands like cd <dir> && <command> > file on Windows. Anthropic says a narrower, more targeted version of the permission check will return in a later release.

Key Takeaways

A one-day-old permission fix got walked back, with Claude Code 2.1.233 reverting Windows Bash permission changes it had shipped in 2.1.232.
The original fix closed a real bypass, where Git Bash followed Cygwin-style symlinks that Claude Code's path validation saw as ordinary files, letting writes skip the approval prompt.
Input redirection permission parity was also reverted, so < file redirections are temporarily no longer checked the same way as their argument-spelled equivalents.
The rollback was triggered by a usability regression, where Windows auto mode users saw ordinary commands like cd <dir> && <command> > file repeatedly stall for manual approval.
Anthropic has committed to a narrower fix, planning to reintroduce more targeted symlink and redirection permission checks in a future release.
Windows users should treat the protection as temporarily withdrawn, since the specific bypass 2.1.232 closed is open again until the follow-up ships.

What Changed

Claude Code 2.1.233 reverted two permission-check changes that had shipped in 2.1.232 just a day before, both specific to Windows. The reverted checks covered two cases:

Writes through Cygwin-style symlinks in Git Bash, which Claude Code's path validation had previously treated as regular files, letting a write bypass the usual approval prompt.
Input redirections such as < file, which had newly been made subject to the same permission checks as their argument-spelled equivalents on all platforms.

Both protections had been added specifically to close a Windows permission bypass: Git Bash could follow a Cygwin-style symlink in a way that Claude Code's path checks did not recognize as a symlink, so a write through it slipped past the approval prompt a user would otherwise see.

Why It Was Rolled Back

The tightened checks introduced a regression on Windows: users running Claude Code in auto mode found that ordinary, safe commands with a redirection, such as cd <dir> && <command> > file, repeatedly stopped for manual approval instead of running as expected. That false-positive rate made the feature disruptive enough that Anthropic chose to revert the underlying permission logic entirely rather than patch around it, restoring the previous behavior on Windows for both symlink writes and redirections.

Why It Matters

This is a trust-boundary change worth flagging on its own: for the moment, the specific symlink-based write bypass that 2.1.232 closed is open again on Windows, and input redirections are no longer held to the same permission standard as other file-writing commands. Anthropic has confirmed a narrower version of the check is planned for a future release, but until then, Windows users relying on Claude Code's permission prompts to catch unauthorized writes through symlinked paths should be aware the protection is temporarily withdrawn.