You Can Rip Out the Whole "Tool That Runs Code"—Claude Code v2.1.248's `--restricted` Hands Least Privilege to Other People's Repos and Unattended Runs

Anthropic's coding agent, Claude Code, shipped version 2.1.248 on August 27, 2026. The headline feature this time is a new launch option, --restricted, that strips the agent entirely of its "tools for running commands and code." It's a mechanism for narrowing down, in advance, the range an agent can reach into (the blast radius) when you open an untrusted repository or run it unattended with no human watching over it.

The Option of an "Agent That Can't Execute"

Until now, Claude Code has stacked up "yes/no" answers at permission prompts, granting command execution and file rewrites as needed. --restricted (or the environment variable CLAUDE_CODE_RESTRICTED=1) tightens all of those premises at once, right at startup. Concretely, it behaves as follows:

• Removes the built-in tools that run commands and code, along with WebFetch (except for those you explicitly name with --tools)
• Confines file-operation tools to the inside of the working directory only
• Refuses bypassPermissions (skipping all permission checks)
• Does not load the user, project, or local settings files

In other words, with a single flag you can create a state where "reads and writes stay inside this folder only, tools that hit external targets are off by default, and settings can't loosen things on their own." Since the design lets you add back only the tools you need via --tools, you can lean toward an approach where the default is locked down and exceptions are stated explicitly.

Why a "Locked-Down Default" Is Needed

This summer, Claude Code and other coding agents saw a string of reports about paths where effects leaked outside the sandbox, and about handy extensions that doubled as entry points for intrusion. The wider the work you delegate to an agent grows—from committing all the way to opening a PR—the higher the cost of a single line that gets carelessly executed. --restricted can be seen as making it possible, in those situations, to choose the surest subtraction of all: "don't hand it a tool that can execute in the first place."

That said, this is no all-purpose shield. It's strictly opt-in; a normal launch still runs the same way as before, stacking up permission prompts. Because it ignores settings files, the convenient permission rules you normally use won't take effect either. It's more accurate to view it as gear you deliberately put on "when handling untrusted targets" or "when running unattended."

The "Leaks" Plugged at the Same Time

v2.1.248 also includes some quiet but effective fixes around unattended operation and cloud integration. The three most likely to matter in real-world use are the following.

Stopping the "Exfiltration" of Credentials

Fixed an issue where cloud sessions launched via /ultrareview or from local would upload uncommitted prod.env-family files, *.tfvars, and even editor swap, temp, and backup files of credential files (such as key.pem.tmp and id_rsa.swo). These now stay on your machine.

Clearing Up the "Once an Hour" Cache Miss

Fixed a bug where, in long-running sessions, tool definitions were redrawn after an OAuth token refresh, causing the prompt cache to be missed roughly once an hour and losing even the extended-thinking context. The longer you run unattended, the more this pays off—an improvement on both cost and quality.

Expanding Cross-Session Coordination Coverage

SendMessage / ListAgents, which pass messages between sessions on the same machine, can now be used via Bedrock, Vertex, and Foundry, as well as in environments with telemetry disabled. For teams that want to bundle parallel agents across a corporate gateway, the handling now lines up.

How It Pays Off

This update isn't a flashy new model but a piece of tooling for "deciding the scope you delegate before you delegate it." While handing execution rights to an agent has become the norm, the means to tip that default toward the safe side has been lacking. --restricted slips a single template of least privilege into "work where trust isn't yet established"—reviewing other people's code, validating samples, unattended batches. A practical order is to first put it on when opening an untrusted repository and check the behavior, then add back only the tools you need with --tools.

References: Claude Code changelog (official) / Releasebot: Claude Code updates / anthropics/claude-code CHANGELOG