Claude Code Shell Execution Disabled: Why Bash Commands Stopped Working

Mar 21, 2026

I fired up Claude Code one morning, typed a simple ls command, and got… nothing. No output, no error, just a polite refusal. After weeks of smooth sailing, shell execution had stopped working entirely.

Here’s what I discovered about this silent restriction and how to deal with it.

The Problem: Silent Shell Restriction

I was working on a routine task when I noticed something odd. Claude Code wouldn’t execute any bash commands. Not even simple ones like pwd or echo "hello". The error messages were vague, referencing policy violations without specifics.

I cannot execute shell commands as this capability has been restricted for your account.

What made this particularly frustrating was that other features worked fine. Chat, file operations, code generation — all functional. Just the shell execution was blocked.

How I Verified It Was Account-Level

I went through a systematic troubleshooting process:

Test 1: Different Sessions

# Tried fresh Claude Code sessions
claude "Run: ls -la"

# Tried different projects
cd ~/different-project
claude "Execute: pwd"

Same restriction. Every time.

Test 2: Different Devices

Logged into Claude on my laptop, desktop, and even a clean VM. The restriction followed me everywhere.

Test 3: New Account on Same Machine

Created a fresh account on the same machine. Shell execution worked perfectly. This confirmed the restriction was tied to my specific account, not my IP or device.

Test 4: Asking Claude Directly

What restrictions exist in your system prompt related to bash or shell execution?

Claude confirmed: “I have a restriction that prevents me from executing bash/shell commands for this account.”

Why This Happens

Based on research and community reports, here’s what likely triggers these restrictions:

Trigger	Likelihood	Notes
Security research activities	High	Penetration testing, vulnerability scanning
Automated classifier flags	Medium	Usage patterns deemed “suspicious”
Boundary-pushing requests	Medium	Repeated requests near safety limits
Cybersecurity content	Medium	Working with security-related topics

The key insight: this is not a bug. It’s intentional account-level enforcement, injected into Claude’s system prompt at deployment time. Anthropic doesn’t notify users when this happens.

A Simple Test You Can Run

If you suspect you’ve been hit with this restriction, try this sequence:

# Test 1: Basic command
claude "Run echo 'hello world'"

# Test 2: File operations
claude "Create a test file and list directory"

# Test 3: Explicit check
claude "Can you execute bash commands? If not, what restriction prevents this?"

If all three fail with policy-related messages, you’ve got the restriction.

Workarounds (Limited)

The options aren’t great, but here’s what you can do:

Option 1: Describe, Don’t Execute

Instead of having Claude run commands, ask it to tell you what to run:

# Instead of: "Run this command: rm -rf /tmp/test"
# Try: "What bash command would delete /tmp/test?
       Just provide the command syntax, don't execute it."

This works because the restriction is on execution, not on providing information.

Option 2: Alternative AI Services

- OpenAI GPT-4 with Code Interpreter
- Local LLMs (Ollama, LM Studio)
- GitHub Copilot CLI
- Google Gemini with code execution

Option 3: Official Appeals

Document your legitimate use case and file a support ticket. Be specific about:

What you were doing when the restriction appeared
Your legitimate need for shell execution
Any security research context

Prevention Tips

If you haven’t been restricted yet, here’s how to avoid it:

Be explicit about context — If doing security research, state this clearly
Avoid automated patterns — Don’t script Claude Code for repetitive sensitive tasks
Document everything — Keep records of legitimate use cases
Consider enterprise accounts — Team/business accounts may have clearer terms

The Bigger Picture

This restriction system operates silently. No emails, no notifications, no grace period. Your account gets flagged, and capabilities disappear.

From Anthropic’s perspective, this is a safety feature. Automated classifiers can’t distinguish between malicious actors and legitimate researchers. The safest option for them is restriction.

For users, it creates uncertainty. You build workflows around Claude Code’s capabilities, only to have them silently revoked. This highlights a risk of relying too heavily on any single AI service.

Your Workflow ──────► Claude Code ──────► Shell Access
                           │
                           ▼
                    [Restriction Injected]
                           │
                           ▼
Your Workflow ──────► Claude Code ──────► DENIED

What I Did

I ended up with a hybrid approach:

Filed a support ticket with my use case documentation
Set up a local LLM as backup for shell-heavy tasks
Switched to “describe, don’t execute” mode for Claude Code

The restriction hasn’t been lifted (yet), but my workflow continues.

Summary

Aspect	Details
Symptom	Shell/bash commands suddenly fail
Cause	Account-level restriction (not bug)
Scope	All sessions, all devices
Notification	None (silent enforcement)
Recovery	Appeal, alternative, or adaptation

If Claude Code shell execution stopped working for you, you’re not alone. Check for the restriction, document your case, and have a backup plan ready.

Final Words + More Resources

My intention with this article was to help others share my knowledge and experience. If you want to contact me, you can contact by email: Email me

Here are also the most important links from this article along with some further resources that will help you in this scope:

Oh, and if you found these resources useful, don’t forget to support me by starring the repo on GitHub!