Claude Code --restricted: an agent that can't run code

Anthropic shipped a Claude Code restricted mode on August 27 in v2.1.248. One flag, --restricted, removes the tools that make a coding agent dangerous. We wrote yesterday about a prompt injection chain that turned "summarize this website" into remote code execution. This is the other half of that conversation.

What actually happened

From the Claude Code changelog, --restricted (or CLAUDE_CODE_RESTRICTED=1) does four things: it removes the built-in tools that run commands or code and WebFetch unless you explicitly name them in --tools, it keeps file tools inside the working directory, it refuses bypassPermissions, and it ignores user, project, and local settings files.

That last item is the one people will skip past. Ignoring settings files means a repo you just cloned cannot hand the agent a .claude/settings.json that quietly re-enables what you turned off. The flag is not a preference the environment can argue with.

The same release train hardened the file tools directly. v2.1.251 lists fixes for file-tool symlink vulnerabilities and plugin path traversal — the class of bug where a link inside a repo points somewhere your working directory does not cover.

Why a restricted agent matters for your business

This is the first Claude Code control that survives a hostile repo. Permission prompts, allowlists, and auto-mode classifiers all run inside a session that untrusted content is actively trying to steer. A flag that deletes the tool before the session starts cannot be talked out of it. Different security model entirely.

Use it as the default for anything reading code you did not write. Client repos during a discovery audit, dependency review, incident triage on a codebase you inherited, any agent pointed at a pull request from outside your org. Read-and-reason work does not need Bash. Give it --restricted and add back a named tool only when the task genuinely requires one.

It does not replace the sandbox. Restricted mode removes tools; it does not contain what remains. File tools still read every file in the working directory, and the model still sends what it reads to an API. Secrets in .env are still secrets in .env. Layer the flag on top of a container and an egress allowlist — the flag is the inner ring, not the wall.

Sources: Claude Code CHANGELOG.