Restricted Mode is what VS Code uses when you open a folder you have not marked as trusted. It disables or limits tasks, the terminal, debugging, workspace settings, extensions and AI agents so that code in the folder cannot run automatically while you read it. It is a speed bump, not a sandbox.
What the feature is for
Opening a repository in an editor feels passive. It is not, because editors read configuration from the project. VS Code's Workspace Trust documentation describes the goal as preventing code execution while you evaluate the safety and integrity of unfamiliar source code.
When you open a new folder, VS Code starts in Restricted Mode and shows a banner and a status bar badge. Choosing that you do not trust the authors keeps it there.
What gets switched off
The documentation lists these areas:
- AI agents: Any file can be pulled into agent context and could carry a prompt injection. Restricted Mode disables agents in that workspace.
- Terminal: Shells can run code based on workspace contents, such as sourcing env files. Opening a terminal is blocked by default.
- Tasks: Task definitions live in the committed .vscode folder, so anyone who clones the repo gets them. Running or even listing tasks prompts for trust.
- Debugging: Debug extensions can launch binaries, so debugging is disabled.
- Workspace settings: Some settings contain paths to executables, such as linters. A set of them is ignored until you trust the folder.
- Extensions: Extensions that have not opted into Workspace Trust are disabled by default.
What it cannot do
The documentation includes a caution worth repeating. Workspace Trust cannot prevent a malicious extension from executing code and ignoring Restricted Mode. Only install extensions from publishers you trust.
It also does nothing for code you run yourself. If you open the folder, then run its install command in an external terminal, Restricted Mode is not involved.
A practical habit
- Treat every folder from a stranger, a job candidate, a bounty report or a random fork as untrusted.
- Read the README, package.json scripts, .vscode folder and any hooks first, while still in Restricted Mode.
- Trust the folder only when you would be comfortable running its scripts.
- If you trust a parent folder for convenience, remember that everything cloned beneath it inherits that trust.
Why developers skip it, and the cost
The prompt is annoying, and many people click trust by reflex. A cloned repo's task file or settings can then run code you never looked at. Spending thirty seconds in Restricted Mode is cheap compared with rotating every credential on the machine.
Teams and shared machines
If you review code from contractors, interview candidates or open source contributors, make Restricted Mode part of the routine, not a personal preference. Write the habit into your onboarding notes: open first, read the project configuration, then decide. Use a separate profile or a disposable environment for anything you genuinely cannot assess, so a wrong call costs you a container and not your credentials.
If you want a quick look at what your projects actually resolve, Safeguard offers SBOM and dependency scanning, and there is a free scan at gold.safeguard.sh/scan.
Quick check
Does Restricted Mode stop a malicious extension?
No. The VS Code documentation says Workspace Trust cannot prevent a malicious extension from executing code and ignoring Restricted Mode.
Are AI agents affected?
Yes. Opening a workspace in Restricted Mode disables agents in that workspace.
Sources
Last reviewed: 19 October 2026.
