[Findings](/findings/index.md) / UX-059

# A security prompt that asks you to approve a command it does not explain, and cuts off

Open · high severity · failure · Claude app (iPhone and iPad)

## What we saw

The prompt says only "Bash wants to run:" above a box of raw shell: a variable holding a long path, then python3 reading a heredoc that rewrites a line in two files (tools/partition.py and tools/site_gate.py). Lines wrap mid-word ("newsro / om", "repos / itory") and the box is cut off with a fade halfway through the line that matters, the replacement string; nothing says whether it scrolls. Above it, a lock icon and its padding take about a quarter of the prompt. Below, two buttons, Deny and a filled black Allow once, which is the visually stronger choice. Nothing on the prompt says, in words, what the command does, which files it changes, whether it touches the network, whether it can be undone, or connects it to the agent's own explanation in the conversation behind the prompt ("team repo records need to move to records/").

![Claude app on iPhone showing a permission prompt: a lock icon, "Bash wants to run:", a box of raw shell and Python cut off with a fade mid-line, and Deny and Allow once buttons](/findings/img/UX-059-bash-permission-prompt.webp)

_The prompt as shown: raw code, wrapped mid-word and cut off mid-line, with no plain-words summary of what it will do._

## Why it matters

The person is asked to make a security decision and given only code to make it with, partly hidden, on a phone. In practice the choice is to stop the work or to trust blindly, and every prompt like this teaches the habit of pressing Allow without reading, which defeats the point of asking. Here the command was harmless (a one-line edit to two files), but the prompt would have looked the same if it were not.

## The fix

Lead with one line in plain words: "Edit 2 files in the newsroom repository: tools/partition.py and tools/site_gate.py (one line each)". Then the facts that decide it, as labels: reads, writes, deletes, network, outside the working directory, reversible. For an edit, show the diff, not the script that makes it. Link the agent's stated reason. Keep the full command one tap away, with real line breaks and no mid-word wrapping. Give Deny and Allow equal weight, or emphasise the safe choice. The short description already exists: the Bash tool asks the agent for a plain-words description of every command it runs, and the prompt does not show it.

## The record

| | |
| --- | --- |
| **Status** | Open |
| **Severity** | High |
| **Kind** | Failure: works against the reader |
| **Product** | [Claude app (iPhone and iPad)](/findings/?product=claude-app-ios), app |
| **Where** | Claude Code session, Bash permission prompt |
| **Problems** | [Uninformed decision](/findings/?problem=uninformed-decision), [Buried content](/findings/?problem=buried-content), [Missing signal](/findings/?problem=missing-signal) |
| **Visibility** | [Obvious](/findings/?visibility=obvious): every reader sees it, every time they reach that point |
| **Recommendation** | [Explain the decision](/findings/?recommendation=explain-the-decision): before asking, say in plain words what will happen, what it touches, whether it can be undone and why it is being asked, with the raw detail one tap away |
| **Area** | [Security decisions](/findings/?area=security) |
| **Breaks** | [A decision comes with what you need to make it](/principles/index.md#informed-decisions) |
| **Observed** | 2026-10-25, not recorded |
| **Last checked** | 2026-10-25, not recorded |
| **Environment** | Claude app on iPhone, portrait, supervising a remote Claude Code session working on the newsroom repository |
| **Source** | [Reported by Dinis Cruz, 25 Oct 2026, with a screenshot](/method/index.md#reports-from-readers) |

Previous: [UX-058 Whether the toolbars hide depends on how fast you scroll, not how far](/findings/UX-058.md)

Next: [UX-060 One unlabelled X throws away the whole recording, with no confirmation](/findings/UX-060.md)