Claude Code Adds a --restricted Flag for Running Against Untrusted Repositories
Claude Code v2.1.248, released August 27, 2026, introduces a --restricted flag (also settable via the CLAUDE_CODE_RESTRICTED=1 environment variable) aimed at safely running the tool against code and configuration you don't fully trust. Restricted mode removes the built-in tools that execute shell commands or run code, and disables WebFetch, unless those tools are explicitly re-enabled by name via --tools. File-editing tools keep working, but are confined to the working directory the session was launched from, and bypassPermissions is refused outright even if requested.
The more consequential change is that restricted mode ignores user, project, and local settings files entirely — meaning a cloned repository cannot smuggle in permission rules, hooks, or tool grants that would otherwise widen what the session is allowed to do just by being checked out. That closes a specific supply-chain-style risk: a malicious .claude/settings.json committed to a repo can no longer grant itself broader tool access the moment someone opens Claude Code inside that checkout. Because the flag is also settable via environment variable, teams can bake it into CI pipelines, shared build runners, or wrapper scripts that invoke Claude Code against arbitrary or third-party repositories without relying on every invocation remembering to pass the flag. The same release also added cross-session messaging (SendMessage/ListAgents) support on Bedrock, Vertex, and Foundry deployments, including when telemetry is disabled, and a per-agent experimental.cacheTtl frontmatter field for tuning prompt-cache lifetime independently of the session-level TTL setting.
Read more — Anthropic
Codex CLI 0.150.0 Adds Cross-Task @ Mentions and Interrupt Hooks
OpenAI shipped Codex CLI 0.150.0 on August 26, 2026, adding "@" mentions that let one Codex task reference and pull context from another running or completed task — useful for splitting a larger piece of work across multiple parallel sessions while still letting them share findings. The release also adds a picker to the /copy command so specific response sections can be copied instead of the whole reply, auto-generated titles for unnamed terminal tasks, clickable rendering for markdown links in supported terminals, and new Interrupt hooks that let external tooling react when a running turn is cancelled mid-execution. Vim-mode users get dot-repeat support in the CLI's editing surface.
The same week brought broader changes to the ChatGPT/Codex product surface: the browser extension that gives ChatGPT visibility into the active tab expanded from Chrome to Edge, Brave, Opera, and Vivaldi, and a new "site tools" mechanism (WebMCP) lets sites expose structured, built-in browser functionality to the assistant rather than relying purely on page scraping. Scheduled tasks also gained event triggers beyond a plain time-based cron: tasks can now fire on incoming Gmail messages filtered by sender or subject, on activity in watched Slack channels, or on GitHub pull request events — turning the scheduled-task feature into a lightweight automation surface for routine developer notifications.
Read more — OpenAI
Anthropic Opens Research Preview of a Standard for AI Agents Operating Physical Hardware
Anthropic began a phased research preview of the Model Hardware Standard (MHS) on August 27, 2026, a shared specification that lets AI agents safely operate physical laboratory and manufacturing equipment such as microscopes, liquid handlers, and robotic arms. The standard is model-agnostic and works with any device exposing a programmable interface, with any agent harness able to access it through standard protocols including the Model Context Protocol — meaning MHS is designed as an integration layer rather than a Claude-specific feature.
Anthropic says the standard is intended to cut the time needed to wire up complex lab or manufacturing machinery for AI-driven control from months down to hours, by giving hardware vendors and lab operators a common interface to target instead of bespoke integrations per device and per agent framework. MHS enables an agent to coordinate multiple instruments in parallel for tasks ranging from routine drug-discovery experiments to laser calibration on a quantum computer. The work began as a collaboration between Anthropic and the HHMI Janelia Research Campus, and access during this research-preview phase is limited to a waitlist of scientific research labs and advanced manufacturers; Anthropic says it plans to publish safety guidance and open-source the standard in a later phase. For developers building agent tooling, MHS is worth watching as an early signal of how agent-hardware safety boundaries — permission scoping, emergency stop semantics, and audit logging for physical actions — get standardized as agents move from software-only environments into contexts with real-world consequences.
Read more — Anthropic
IntelliJ IDEA 2026.2.1 Ships Terminal, Formatting, and VCS Fixes
JetBrains released IntelliJ IDEA 2026.2.1 in late August 2026 as the first minor update following the 2026.2 feature release. The update is bug-fix only: Markdown-embedded shell scripts now execute in the correct order, Undo works correctly again after running "Optimize imports" on the fly, dragging a terminal tab after using "Move to Editor" no longer restarts the underlying terminal session, the IDE no longer throws exceptions from the newer Mercurial conflict-resolution mechanism, and Java code formatting now correctly honors the "Smart tabs" setting. The update is available through the IDE's built-in updater, the JetBrains Toolbox App, or via snap on Ubuntu.
Read more — JetBrains
Links & Sources
You May Also Enjoy
