Running an autonomous AI agent inside a random, unvetted repository you just cloned
off GitHub, I mean, it is kind of terrifying when you really think about what it
could do.
Crikey, mate, it really is.
You hand an agent free rein in your terminal, and one rogue script or hidden
instruction in a repo file could have it running wild.
But Anthropic just rolled out Claude Code version 2.1.248, brought to you by
Jellypod AI, and it introduces a built in restricted flag specifically for this.
Right!
You can pass the restricted flag on the command line or set the environment variable
CLAUDE CODE RESTRICTED equals one.
And what that does right out of the box is strip away tools that execute arbitrary
code or commands.
So Bash and WebFetch are completely disabled by default.
Exactly.
It puts the agent in a proper sandbox.
Any file operations are locked strictly inside your current working directory,
so it cannot go snooping around your home folder or system directories.
And if an agent tries to request bypassPermissions, the system refuses it outright.
That is huge.
And it also ignores all local, project level, and user level dot claude settings
files.
So a malicious repo cannot hijack your setup with a sneaky config file you did not
know was there.
Yeah, spot on.
So if you are reviewing an unvetted pull request or checking out some fresh open
source code, you just launch with the restricted flag.
If you still want the agent to edit code safely without shell access,
you can selectively allow specific tools by adding the tools flag set to Write and
Edit.
Just keep in mind that if your normal workflow relies on running tests,
build commands, or custom workspace hooks, those will get blocked.
It is a strict lockdown by design, so you trade shell automation for total safety.
Beyond security, version 2.1.248 also fixed a brutal bug with prompt caching.
Before this patch, whenever your OAuth token refreshed roughly once an hour,
Claude Code re rendered tool definitions behind the scenes.
Which caused a total prompt cache miss every single hour!
You would lose all your cached context and extended thinking state mid session.
Having that fixed is a massive relief for long coding sessions.
And they trimmed down the Workflow tool as well.
By moving its detailed script authoring reference into a separate skill,
the prompt footprint dropped from 5.7k tokens down to just 1k tokens.
That is a ton of context window reclaimed on every single turn.
Safer repos, persistent caching, and leaner prompts, all in one update.