What happened
Claude Code was prompted to run marker commands. Protected-path variants reportedly executed despite the hook returning ask; a corresponding Write test reportedly created a .claude file.
2026-10-21
MediumPrimaryClaude Code Protected-Path Writes Can Override a Hook Approval Gate in Noninteractive Bypass Mode
A primary Claude Code report shows marker-file writes despite hook ask decisions in noninteractive bypass mode. Explicit deny bypass was not demonstrated.
Claude CodeGovernance bypassAuthor-reported controlled approval-hook precedence reproductionClaude Code 2.1.302 on Windows 11 with Git Bash, claude -p and bypassPermissions
Why it matters
No production loss, force-push or data theft is established. The controlled tests created local marker files; the reporter separately describes an agent commit passing the intended gate.
Missing authorization check
A tool call's action-specific approval requirement must not be weakened by another operation in the same call or silently overridden in unattended execution.
Would PP block it?
An integrated external execution sink could require authenticated authority for the exact command, argument set, workspace and effect before dispatch. It must not trust the client's claim that an unrelated protected-path write authorized the entire call. This integration was not tested and does not repair client hook precedence.
Incident analysis
Timeline and technical read
Timeline
2026-10-21
The reporter opens Claude Code issue 103994 with reproduction steps, marker outcomes, controls and a deny-based workaround.
Technical breakdown
- A PreToolUse hook returns ask for Bash calls containing a marker, tested through an explicit claude -p invocation.
- Ordinary marked commands reportedly did not execute, but variants writing under .git or .claude created the markers in bypassPermissions mode.
- The same protected-path variant reportedly remained blocked in default and acceptEdits modes; a Write-tool test showed a corresponding protected-file creation outcome.
- The reporter's workaround returns deny for the affected combination and requests splitting the command. This does not demonstrate that deny itself can be overridden.
Authorization boundary
Where the authorization boundary should have been
This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
- If enforced at
- Independent Bash and file-write execution boundaries outside the affected client hook resolution
- Still needs
- PP does not fix Claude Code hook precedence. No protection is established if the agent can execute outside the integrated sink or if enforcement uses only the affected ask hook. An explicit deny override was not demonstrated.
- Receipt required for
- Executing the exact shell command, committing a specified change or writing the specified protected file
An independently enforced execution boundary could preserve action-bound approval requirements, but protection is not established if it relies solely on the affected ask hook.
Related incidents and controls
Start small
Put the relevant gate at this action boundary.
This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.