Claude Code v2.1.248 adds restricted mode for safe CI/CD use and expands multi-agent messaging to enterprise clouds

Claude Code v2.1.248, released on 27 August 2026, makes three meaningful additions: a restricted mode designed for CI pipelines and shared runners, cross-session agent messaging on Bedrock, Vertex, and Foundry, and per-agent prompt cache TTL in agent frontmatter. Here is what each of those means in practice.

Restricted mode: one flag, four hard limits

The headline change is --restricted, or its environment variable equivalent CLAUDE_CODE_RESTRICTED=1. Set either when starting a session and four things happen simultaneously:

• Command and code execution is removed, along with WebFetch
• File tools are confined to the working directory only
• bypassPermissions is refused outright
• All user, project, and local settings files are ignored

That last point matters in shared infrastructure. On a standard CI runner, there is no guarantee about what settings files might already exist on the machine. Restricted mode sidesteps the problem entirely by ignoring them. If you need to re-add specific tools, you can still do so explicitly with --tools.

The practical upshot is that you can drop Claude Code into a shared CI pipeline or hosted runner and make a concrete guarantee about what it can and cannot do. It cannot shell out, cannot reach the web, cannot touch files outside the working directory, and cannot be coaxed into bypassing its own permission model. For organisations that have wanted to use Claude Code in automated pipelines but had concerns about running it on shared infrastructure, this is the feature that unblocks it.

Cross-session messaging now works on enterprise cloud backends

Cross-session messaging, the ability for Claude Code sessions to find and communicate with each other using ListAgents and SendMessage, was introduced in v2.1.224 during the week of 3 August 2026. Before v2.1.248, it was limited to sessions connecting through Anthropic’s own API. Enterprise users running Claude Code against Amazon Bedrock, Google Cloud’s Vertex AI, or Microsoft Foundry could not use it.

That restriction is lifted in this release. Sessions on the same machine, regardless of which backend they connect through, can now discover and message each other. The feature also works when telemetry is disabled, which matters for organisations whose security policies prohibit telemetry.

The mechanics are straightforward. Sessions communicate over a local socket and never route through Anthropic’s servers. A session calls ListAgents to see what other sessions are available, then SendMessage to deliver a message by name. There are built-in safeguards: repeated messages from the same sender are rate-limited, identical messages arriving in a short window are dropped, and each session’s unread queue is capped at 50 messages. A runaway loop between two sessions will stop itself.

What this unlocks for teams building multi-agent workflows on private cloud deployments is significant. Two sessions working on interdependent tasks, say one handling a database migration and another building the API layer that depends on it, can now coordinate directly. The migration session can signal the API session the moment it finishes without you manually copying anything between terminals.

Per-agent prompt cache TTL

The release adds experimental.cacheTtl to agent frontmatter, accepting either "5m" or "1h". This sets a per-agent cache TTL that applies when no subagent-level TTL is configured in global settings. It is a fine-grained override rather than a standalone feature, but useful in long-running workflows where different agents have very different cache requirements. An agent that runs briefly every few minutes has different caching needs from one that runs for an hour, and you can now express that difference in the agent definition itself.

The same release also fixes a related bug: prompt-cache misses, and lost extended-thinking context, were occurring roughly once an hour in long sessions because tool definitions were being re-rendered after an OAuth token refresh. That is now fixed.

Other fixes worth knowing about

A few other changes in this release are worth noting:

Windows path bypass closed. Paths spelled with the NT \\?\ device prefix were bypassing UNC path validation, which could leak NTLM credentials. That is patched in this release.

Non-interactive session resilience. Sessions run with -p, via the SDK, or on cloud backends will now automatically continue if a response is cut off mid-stream by a server error, connection loss, or stall. Previously the session would end with an error; now it picks up where it left off.

Subagent results marked as partial. If a subagent hits its maxTurns limit, it now returns its output marked as partial with a hint to continue via SendMessage, rather than appearing to have finished cleanly. This makes it easier to tell the difference between a completed task and one that ran out of turns.

MCP streaming fix. MCP v2 connections were endlessly reopening the subscriptions/listen stream against servers that close long-held streams on a fixed timeout, which is common on serverless hosts. That loop is fixed.

Notification hooks under Claude Desktop and VS Code. Notification hooks were not firing for permission prompts when running under Claude Desktop or VS Code. Fixed in this release.

Linux CPU spike. Idle sessions on Linux were sometimes pinning one CPU core at 100% when sandboxing was enabled. That is resolved.

What this release signals

Restricted mode is the clearest indication yet that Anthropic is building Claude Code to run unattended on infrastructure it does not control. The feature exists precisely because running an AI agent on a shared runner raises legitimate concerns, and Anthropic has responded with a hard, auditable guarantee rather than documentation asking users to trust default behaviour.

The expansion of cross-session messaging to Bedrock, Vertex, and Foundry follows the same pattern: capabilities that existed for standard API users are being extended to enterprise cloud deployments, closing the gap between what organisations can do on private infrastructure and what is available through Anthropic’s own API.

If you are running Claude Code in CI, --restricted is worth enabling on 27 August 2026 onwards. If you are building multi-agent workflows on Bedrock, Vertex, or Foundry, the updated Claude Code changelog has the full details on configuring cross-session messaging for your backend.