Anthropic’s Claude Code, the command-line AI coding agent that can read, edit, and test code autonomously, now runs on Windows 10 and 11 through Windows Subsystem for Linux (WSL). First released as a research preview in February 2025 and generally available since May 2025, the tool has recently gained wider attention amid exaggerated reports of market upheaval. For Windows developers eager to experiment, the real story isn’t about replacing software engineers—it’s about understanding what the agent can really do, how to use it safely, and where the permission model falls short.

What Is Claude Code and How Does It Work on Windows?

Claude Code isn’t an IDE plugin like GitHub Copilot or a chatbot you paste snippets into. It’s a terminal-based agent. You install it via npm or a standalone installer inside a Linux environment—on Windows, that means WSL 2, or an alternative like Git Bash. Once launched, it gets direct access to your project directory: it can read files, write changes, execute shell commands, run tests, and interact with Git.

Anthropic’s own documentation describes it as an “agent that can inspect a codebase, edit files, run tests, use command-line tools and work with GitHub while the developer remains in control.” In practice, you give it a task like “refactor the authentication module” or “debug why the payment API returns a 500 error,” and it will explore the repository, propose changes, and—if you approve—apply them. This is a step beyond autocomplete: it handles multi-file refactors, writes new functions, and can even install dependencies if needed.

But that power comes with requirements. On Windows, there’s no native PowerShell integration. You’ll need a working WSL 2 instance with a Linux distribution (Ubuntu, Debian, etc.), Node.js 18 or later, and your code repository mounted inside the Linux filesystem for best performance. Anthropic also supports using Git for Windows with Git Bash, though WSL 2 is the recommended path for full capabilities.

The Security Model – and Where It Gets Dangerous

Out of the box, Claude Code is designed to ask permission. It defaults to read-only access for file views; writes and most shell commands require explicit approval via a terminal prompt. You can audit its planned actions before granting the go-ahead. For routine development, that’s a sensible guardrail.

But the documentation is clear: this is not a security boundary. Anthropic warns that granting file and command access introduces prompt-injection and data-exfiltration risks. If your repository contains untrusted content—like a readme with malicious instructions, or third-party libraries with embedded prompts—the agent could be manipulated into leaking secrets or running dangerous commands. The risk is especially acute if the project includes .env files, deployment scripts, or cloud credentials.

The most hazardous option is the --dangerously-skip-permissions flag. When enabled, Claude Code will run without any permission prompts—reading, writing, and executing commands automatically. Anthropic explicitly recommends using this mode only in an isolated environment, such as a container with no network access. For any real project, it’s a non-starter.

On Windows, the WSL layer adds another consideration: files and credentials can straddle the boundary between the Windows host and the Linux guest. A compromised agent inside WSL could potentially access files in /mnt/c if permissions allow, or exploit interop features. That means enterprise administrators need to treat a Claude Code-enabled WSL environment as a high-privilege sandbox that demands containment.

Setting Up a Safe Development Environment on Windows

For individual developers or teams on Windows wanting to try Claude Code, the following steps can reduce exposure:

  • Use a fresh WSL distribution. Don’t install the agent inside your primary development environment with years of accumulated configs and secrets. Spin up a new WSL instance (wsl --install -d Ubuntu-22.04) dedicated to Claude Code experiments.
  • Clone repositories into the Linux filesystem, not /mnt/c. The Linux-native ext4 filesystem inside WSL is faster and avoids potential permission issues. Plus, it creates a clearer separation from your Windows documents.
  • Scan for secrets before running. Use tools like git-secrets or trufflehog to ensure no credentials, API keys, or private tokens are lurking in the repo. If the agent encounters them, it won’t know to keep them safe.
  • Disable network access when using --dangerously-skip-permissions. If you absolutely need that flag for scripting, run Claude Code inside a Docker container with --network none, or a WSL instance with networking temporarily disabled.
  • Review every change. Treat Claude Code’s output like a junior developer’s pull request: read the diffs, run the tests, and never trust auto-generated modifications blindly. Retain normal CI/CD pipelines with code review and static analysis.
  • Limit tool exposure. In the agent’s configuration file (.claude/settings.json), you can restrict which commands it’s allowed to execute. For example, you might block rm -rf or sudo unless explicitly needed.

Enterprises evaluating wider adoption should require standard controls: dedicated sandbox accounts, network segmentation, audit logging of agent actions, and mandatory PRs before any code lands in main branches. The agent accelerates typing, not judgment.

From Copilot to Autonomy: A Quick History

The path to agentic coding didn’t start with Claude Code. Microsoft’s GitHub Copilot launched in 2021 as an inline autocomplete tool, predicting the next line or function. Tools like Cursor later added chat interfaces, letting developers ask questions about their codebase. But these remained fundamentally reactive: they responded to a human prompt and rarely took action beyond a text insertion.

Claude Code belongs to a new wave of “agentic” tools that can plan multi-step tasks, use external tools, and recover from errors. Anthropic first shipped a limited research preview on February 24, 2025, then tied the 1.0 release to the Claude 4 model family in May 2025. Since then, the company has raised usage limits and inked enterprise deals (as reported by Ars Technica in May 2026), signaling a serious push to make agentic coding a developer staple.

Competitors aren’t standing still. OpenAI’s Codex CLI and other terminal-based agents have emerged, each with similar capabilities. The critical differentiator for Windows users right now is platform support: Claude Code’s reliance on WSL keeps it one degree removed from native Windows toolchains, unlike some rivals that integrate directly with PowerShell. That may change, but for now, it’s a Linux-centric experience.

Sorting Fact from Hype

A recent Streamlinefeed report claimed Claude Code “surg[ed] to prominence in early 2026” and linked it to stock-market pressure on outsourcing firms, while also suggesting heavy use consumes electricity comparable to running a dishwasher daily. These assertions aren’t backed by publicly available data. The tool has been publicly available since May 2025, not early 2026. And while AI inference does draw power, no transparent methodology has been provided for the dishwasher comparison.

Such overstatements can mislead decision-makers into overestimating the tool’s autonomy. Claude Code is powerful, but it still makes mistakes, hallucinates APIs, and requires human supervision. It won’t replace a senior engineer; it can, however, make that engineer dramatically more productive—provided it’s used with the same caution you’d apply to any code that can run arbitrary commands on your machine.

What to Watch Next

Anthropic has stated that Windows support is “through WSL” for now, but as enterprise demand grows, a native Windows version or a PowerShell module could appear. The company is also iterating quickly—keep an eye on the official changelog for new permission controls or isolation features.

For IT administrators, the arrival of agentic tools inside WSL environments may accelerate the need for Windows sandboxing improvements. Features like “Windows Sandbox” or enhanced WSL security options might become part of the standard developer toolkit. In the meantime, treat Claude Code as a valuable but sharp instrument: with the right sheaths in place, it can carve out remarkable productivity gains without cutting your team.