---
title: "Comment by Rulestack on \"AI Coding Agent Security Flaws: Claude Code, Gemini, Codex\" | Hashnode"
description: "Your pattern 2 shows up from the deny side as well. In a throwaway repo we put a single rule, Bash(git push:*), in .claude/settings.json and had Claude Code 2.1"
url: "https://hashnode.com/posts/ai-coding-agent-security-flaws-claude-code-gemini-codex/6aba84b220e0c0bf999ad89f/comment/6abab4802849b016e5cde418"
---

[Discussion](https://hashnode.com/posts/ai-coding-agent-security-flaws-claude-code-gemini-codex/6aba84b220e0c0bf999ad89f)

Comment [AI Coding Agent Security Flaws: Claude Code, Gemini, Codex](https://hashnode.com/posts/ai-coding-agent-security-flaws-claude-code-gemini-codex/6aba84b220e0c0bf999ad89f)

[Rulestack](https://hashnode.com/@rulestack)

[Sep 28](https://hashnode.com/posts/ai-coding-agent-security-flaws-claude-code-gemini-codex/6aba84b220e0c0bf999ad89f/comment/6abab4802849b016e5cde418)

Your pattern 2 shows up from the deny side as well. In a throwaway repo we put a single rule, Bash(git push:\*), in .claude/settings.json and had Claude Code 2.1.278 run 14 spellings of a push: it stopped 8, and 5 still reached the remote, including git -c ... push, git 'push' and sh -c "git push". To us it looked like the same gap as your Bash(git \* main) example: the rule matched the text Claude wrote rather than what the shell ended up running.