1
00:00:00,140 --> 00:00:04,940
Running an autonomous AI agent inside a
random, unvetted repository you just cloned

2
00:00:04,960 --> 00:00:09,479
off GitHub, I mean, it is kind of
terrifying when you really think about what it

3
00:00:09,500 --> 00:00:09,880
could do.

4
00:00:10,537 --> 00:00:11,996
Crikey, mate, it really is.

5
00:00:12,617 --> 00:00:16,796
You hand an agent free rein in your
terminal, and one rogue script or hidden

6
00:00:16,857 --> 00:00:19,877
instruction in a repo file could have it
running wild.

7
00:00:20,476 --> 00:00:25,776
But Anthropic just rolled out Claude Code
version 2.1.248, brought to you by

8
00:00:25,896 --> 00:00:30,716
Jellypod AI, and it introduces a built in
restricted flag specifically for this.

9
00:00:30,971 --> 00:00:31,311
Right!

10
00:00:31,711 --> 00:00:35,591
You can pass the restricted flag on the
command line or set the environment variable

11
00:00:35,951 --> 00:00:38,371
CLAUDE CODE RESTRICTED equals one.

12
00:00:38,931 --> 00:00:42,951
And what that does right out of the box is
strip away tools that execute arbitrary

13
00:00:43,011 --> 00:00:44,691
code or commands.

14
00:00:44,752 --> 00:00:47,871
So Bash and WebFetch are completely
disabled by default.

15
00:00:47,917 --> 00:00:48,477
Exactly.

16
00:00:48,584 --> 00:00:50,877
It puts the agent in a proper sandbox.

17
00:00:50,977 --> 00:00:55,197
Any file operations are locked strictly
inside your current working directory,

18
00:00:55,250 --> 00:00:58,797
so it cannot go snooping around your home
folder or system directories.

19
00:00:58,897 --> 00:01:03,757
And if an agent tries to request
bypassPermissions, the system refuses it outright.

20
00:01:03,989 --> 00:01:05,069
That is huge.

21
00:01:05,610 --> 00:01:10,509
And it also ignores all local, project
level, and user level dot claude settings

22
00:01:10,589 --> 00:01:10,909
files.

23
00:01:11,409 --> 00:01:15,849
So a malicious repo cannot hijack your
setup with a sneaky config file you did not

24
00:01:15,869 --> 00:01:16,429
know was there.

25
00:01:16,738 --> 00:01:17,737
Yeah, spot on.

26
00:01:18,357 --> 00:01:22,757
So if you are reviewing an unvetted pull
request or checking out some fresh open

27
00:01:22,878 --> 00:01:25,777
source code, you just launch with the
restricted flag.

28
00:01:26,458 --> 00:01:29,897
If you still want the agent to edit code
safely without shell access,

29
00:01:30,437 --> 00:01:35,597
you can selectively allow specific tools
by adding the tools flag set to Write and

30
00:01:35,718 --> 00:01:35,997
Edit.

31
00:01:36,042 --> 00:01:39,882
Just keep in mind that if your normal
workflow relies on running tests,

32
00:01:39,935 --> 00:01:44,122
build commands, or custom workspace hooks,
those will get blocked.

33
00:01:44,282 --> 00:01:49,642
It is a strict lockdown by design, so you
trade shell automation for total safety.

34
00:01:49,784 --> 00:01:56,484
Beyond security, version 2.1.248 also
fixed a brutal bug with prompt caching.

35
00:01:57,224 --> 00:02:01,364
Before this patch, whenever your OAuth
token refreshed roughly once an hour,

36
00:02:01,884 --> 00:02:04,864
Claude Code re rendered tool definitions
behind the scenes.

37
00:02:04,917 --> 00:02:09,677
Which caused a total prompt cache miss
every single hour!

38
00:02:09,747 --> 00:02:14,437
You would lose all your cached context and
extended thinking state mid session.

39
00:02:14,540 --> 00:02:18,677
Having that fixed is a massive relief for
long coding sessions.

40
00:02:18,667 --> 00:02:20,747
And they trimmed down the Workflow tool as
well.

41
00:02:20,934 --> 00:02:24,747
By moving its detailed script authoring
reference into a separate skill,

42
00:02:24,787 --> 00:02:29,867
the prompt footprint dropped from 5.7k
tokens down to just 1k tokens.

43
00:02:30,094 --> 00:02:34,295
That is a ton of context window reclaimed
on every single turn.

44
00:02:34,974 --> 00:02:39,295
Safer repos, persistent caching, and
leaner prompts, all in one update.