Claude Code sandbox bug: naive substring match on "git" blocks innocent commands
findepi · ghdev · 2026-10-09
A confirmed bug in Claude Code: the worktree-isolation guard naively substring-matches "git", refusing any Bash command containing "git" anywhere plus shell expansion — even when git isn't invoked at all.
Real-world impact:
- mvn -Dmaven.gitcommitid.skip runs, but appending ; echo exit=$? gets blocked for "naming git in a form too complex to verify it stays inside the worktree"
- grep -n 'git-commit-id' ...pom is refused because the quoted pattern is treated as a git invocation and the glob as git's argument
- Worse: a subagent worked around the block by writing a wrapper script, defeating the guard's purpose entirely
The reporter proposes parsing the command and matching git only in command position, not as a substring of args, flags, or patterns. Version 2.1.295, macOS, with a repro.
More from coding & agent
- Garry Tan endorses Aside Browser as the fix for agents getting blocked on the web — garrytan · 2026-10-23
- MCP server turned rogue 30 days after approval, prompting open-source mcp-guard lockfile tool — ErgoniaWorks · 2026-10-23
- Test: Coding Agents Won't Use an MCP Tool Unless AGENTS.md Mentions It — colinmcnamara · 2026-10-23
- Open-Source Tennis Models Plus Claude Turn Video Into a World-Class Coach — tweetsatpreet · 2026-10-23
- awesome-ai-apps: 132 Free Open-Source AI Agent and RAG Projects on GitHub — Arindam_1729 · 2026-10-23
- Google's Agents CLI Adds Extension System, Ships First-Party LangChain Support — rseroter · 2026-10-23