text:
Make your language unusable
Try to write some code in your language and make it not satisfying our criteria of being a programming language any more.
A language satisfies our criteria (simplified version for this challenge) of being a programming language if:

It can read user input representing tuples of positive integers in some way.
It can output at least two different possible results depending on the input.
It can take two positive integers and add them (and the result can affect the output).
It can take a positive integer and decide whether it is a prime (and the result can affect the output).
For the purpose of this challenge, any kind of output that isn't an allowed output method for a normal challenge is ignored. So it doesn't matter whether the program can also play a piece of music, or posting via HTTP, etc.
Update: You can also choose one or some of the allowed output methods, and ignore all the others. But you must use the same definition everywhere in the following criteria. And if your program can disable more than one output methods — that worths more upvotes.

Examples like making it not able to output, or disabling all the loop constructs so it won't be able to do primality test and making sure the user cannot re-enable them.
You should leave a place for inserting new code. By default, it is at the end of your code. If we consider putting the source code in that place in your answer and running the full code as a complete program the interpreter of a new language, that language should not satisfy the criteria.
But the inserted code must be executed in such a way like a language satisfying the criteria:

The inserted code must be grammatically the same as something (say it's a code block in the following criteria) that generally do satisfy the criteria, from the perspective of whoever wants to write a syntax highlighter. So it cannot be in a string, comment, etc.
The inserted code must be actually executed, in a way it is supposed to satisfy the criteria. So it cannot be in an unused function or sizeof in C, you cannot just execute only a non-functional part in the code, and you cannot put it after an infinite loop, etc.
You can't limit the number of possible grammatically correct programs generated this way. If there is already something like a length limit in the language you are using, it shouldn't satisfy the criteria even if this limit is removed.
You can't modify or "use up" the content of input / output, but you can prevent them from being accessed.
These criteria usually only applies to languages without explicit I/O:

Your code should redirect the user input (that contains informations of arbitrary length) to the inserted code, if a code block isn't usually able to get the user input directly / explicitly in the language you are using.
Your code should print the returned value of the inserted code, if a code block isn't usually able to output things directly / explicitly in the language you are using.
In case you print the returned value, and it is typed in the language you are using, the returned type should be able to have 2 different practically possible values. For example, you cannot use the type struct {} or struct {private:int x;} in C++.

This is popularity-contest. The highest voted valid answer (so nobody spotted an error or all errors are fixed) wins.
Clarifications

You shouldn't modify the code in the text form, but can change the syntax before the code is interpreted or compiled.
You can do other things while the code is running. But the reason that it doesn't satisfy the criteria should be within the inserted code itself. It can error because of the interference of another thread, but not just be killed by another thread.
All the specs basically means it should be grammatically likely satisfying the criteria if all the built-ins were not changed but not actually do. It's fine if you find any non-grammatical workarounds, such as passing the parameters to the code block correctly, but make them not able to be used in some way.
Again, the inserted code must be actually executed. Code after an infinite loop or crashing is considered "not actually executed", thus not valid. Those answers might be interesting, but there are already some other infinite loop or crashing questions on this site, and you may find a more appropriate one to answer. If not, consider asking a new question. Examples of those questions are:

Shortest infinite loop producing no output
Why isn't it ending?
Loop without 'looping'
Challenge: Write a piece of code that quits itself
Ridiculous Runtime Errors
Crash your favorite compiler

Leaderboard

var QUESTION_ID=61115/*,OVERRIDE_USER=8478*/;function answersUrl(e){return"https://api.stackexchange.com/2.2/questions/"+QUESTION_ID+"/answers?page="+e+"&pagesize=100&order=desc&sort=creation&site=codegolf&filter="+ANSWER_FILTER}function commentUrl(e,s){return"https://api.stackexchange.com/2.2/answers/"+s.join(";")+"/comments?page="+e+"&pagesize=100&order=desc&sort=creation&site=codegolf&filter="+COMMENT_FILTER}function getAnswers(){jQuery.ajax({url:answersUrl(answer_page++),method:"get",dataType:"jsonp",crossDomain:!0,success:function(e){answers.push.apply(answers,e.items),answers_hash=[],answer_ids=[],e.items.forEach(function(e){e.comments=[];var s=+e.share_link.match(/\d+/);answer_ids.push(s),answers_hash[s]=e}),e.has_more||(more_answers=!1),comment_page=1,/*getComments()*/(more_answers?getAnswers():process())}})}/*function getComments(){jQuery.ajax({url:commentUrl(comment_page++,answer_ids),method:"get",dataType:"jsonp",crossDomain:!0,success:function(e){e.items.forEach(function(e){e.owner.user_id===OVERRIDE_USER&&answers_hash[e.post_id].comments.push(e)}),e.has_more?getComments():more_answers?getAnswers():process()}})}*/function getAuthorName(e){return e.owner.display_name}function process(){var e=[];answers.forEach(function(s){var r=s.body;s.comments.forEach(function(e){OVERRIDE_REG.test(e.body)&&(r="
"+e.body.replace(OVERRIDE_REG,"")+"
")});var a=r.match(SCORE_REG);a&&e.push({user:getAuthorName(s),score:s.score,language:a[1],lang:jQuery('
').html(a[1]).text(),link:s.share_link})}),e.sort(function(e,s){var r=e.score,a=s.score;return a-r});var s={},r=1,a=null,n=1;e.forEach(function(e){e.score!=a&&(n=r),a=e.score,++r;var t=jQuery("#answer-template").html();t=t.replace("{{PLACE}}",e.n=n+".").replace("{{NAME}}",e.user).replace("{{LANGUAGE}}",e.language).replace("{{SIZE}}",e.score).replace("{{LINK}}",e.link),t=jQuery(t),jQuery("#answers").append(t);var o=e.language;/s.lang.toUpperCase())-(e.lang.toUpperCase()<s.lang.toUpperCase())||(e.lang>s.lang)-(e.lang<s.lang)});for(var c=0;c<t.length;++c){var i=jQuery("#language-template").html(),o=t[c];i=i.replace("{{PLACE}}",o.n).replace("{{LANGUAGE}}",o.language).replace("{{NAME}}",o.user).replace("{{SIZE}}",o.score).replace("{{LINK}}",o.link),i=jQuery(i),jQuery("#languages").append(i)}}var ANSWER_FILTER="!t)IWYnsLAZle2tQ3KqrVveCRJfxcRLe",COMMENT_FILTER="!)Q2B_A2kjfAiU78X(md6BoYk",answers=[],answers_hash,answer_ids,answer_page=1,more_answers=!0,comment_page;getAnswers();var SCORE_REG=/<(?:h\d|(?!.*<h\d>)p)>\s*((?:[^,;(\s]| +[^-,;(\s])+)(?=(?: *(?:[,;(]| -).*?)?\s*<\/(h\d|p)>)/,OVERRIDE_REG=/^Override\s*header:\s*/i;
body{text-align:left!important}#answer-list,#language-list{padding:10px;float:left}table{width:250px}table thead{font-weight:700}table td{padding:5px}
 <link rel="stylesheet" type="text/css" href="https://cdn.sstatic.net/Sites/codegolf/all.css?v=7509797c03ea">

Leaderboard

	Author	Language	Score

Sorted by Language

	Language	User	Score

{{PLACE}}	{{NAME}}	{{LANGUAGE}}	{{SIZE}}	Link

{{PLACE}}	{{LANGUAGE}}	{{NAME}}	{{SIZE}}	Link

Am I allowed to change the code before executing it? Also, can I run other code whilst I am running the code given?

@muddyfish Basically no and yes. See the clarifications.

If it wasn't for #{...}, I'd have a neat GolfScript answer...

What about code that executes an infinte loop, so your code after it  never gets executed. Is that valid?

@ppperry If the inserted code is after the infinite loop so it is not executed, then no. If the inserted code runs into a infinite loop itself, it's fine.

I'm not sure what the update means. If the intention is that it's sufficient to break print statements and you can claim to be ignoring output to a file then I think the current wording allows you to claim to be ignoring all standard output mechanisms.

@PeterTaylor How? And note that the grammatically equivalent reference must satisfy the criteria in any definition you choose.

What do you mean by that? That if you want to ignore all output mechanisms, you have to provide a new one?

And if so, that seems to be in stark contradiction to the way you haven't complained that the answers which close stdin are violating the rule "Your code should redirect the user input (that contains informations of arbitrary length) to the inserted code, if a code block cannot get the user input directly in the language you are using.".

This could have made a really great cops and robbers challenge I think.

@DankMemes Agreed. As it stands, it's much too vague, and most answers would be invalidated by finding a workaround. CnR with this premise would be delightful.

@PeterTaylor You should choose at least one output mechanism and ignore all other mechanisms. For the later comment, I have changed "cannot" to "isn't usually able to". It's only meant to prevent answers doing nothing in a language without explicit IO.

@Sp3000 Rephrased that part a bit and hope it became clearer.

@DankMemes There is a related cops-and-robber in the sandbox by feersum, which removed the part about hacking existing languages, but just write a new language for the robbers to use.

So then it seems to be saying that in languages with explicit IO it's permissible to do completely boring things like reading and discarding the contents of stdin. It sets up a completely unfair playing field where some languages require you to carefully handle the IO for the inserted code, and other languages allow you to trash it and deny IO to the inserted code.

@PeterTaylor Added a criteria to disallow it. I'm not sure this solves all the problems.

I assume this is not allowed, but figured i would check: can I modify the user code at runtime?

@pseudonym117 No. See clarifications.

What about solutions that redefine some of the required operations to produce invalid output, like 2 + 2 = false?

A lot of the answers below make the new inserted code error out. Is that OK? I mean, is it OK to modify your runtime/language in such a way that all new code are errors?

@jdphenix That's ok, and is the supposed way solving this challenge.

@slebetman I think it is ok. Technically, only "limiting the number of possible grammatically correct programs" is currently forbidden.

Are these answers satisfying what you were looking for? Break the language so it's unusable or were you hoping for something else?

@Luminous Some of them doesn't. The intention was to break the language by redefining the language, not by running into an infinite loop, etc, which is a normal features of any Turing-complete language.

@jimmy23013 the clarifications do not exactly clarify what i meant to ask. What I meant was can I do something like this (using .NET as an example): before the IL code is JIT compiled to native code, change all of the IL op codes in the user program into NOPs. So the instructions would be called, they would just do nothing.

@pseudonym117 I think it shouldn't be allowed, as the NOPs doesn't exist in the original program. But upvote the following comment if you think it should be allowed.

Does PHP count?

@AlecTeal Why not?

@jimmy23013 you missed the joke.

@jimmy23013 My answer changes the Code but not the co_code. Should it be allowed?

Hmmm.  Guess the "do no harm" oath didn't exactly make it to software engineering?  Oh well.  Makes it more interesting.  Set the controls for the center of the Sparc.

@Dr.Rebmu It's not always easy to do harm, though, and some of the harmful unusable jails are broken by someone else. And welcome back here.

@muddyfish You can change how the code is interpreted, or the supporting libraries, etc, or the behavior of the compiler before the code is parsed / compiled / linked into that, but not the part the code itself compiled into, after it is compiled.

@jimmy23013 I may or may not finish my language, new tricks up my sleeve coming, but I stopped by because this was "trending" in the sidebar.  So no promises.

Can program runtime be considered output? EG if I have STDIN but not STDOUT, is simply running for a different length of time based on primality of input number enough?

@shelvacu No. That's not an allowed output method and is ignored.

Deleted the poll comments. An answer compiling the inserted code and modifying the compiled code isn't allowed.

Apparently I'm not allowed to post an answer on this question, but would exec gzip $0 count for bash? It makes the currently executing script hide in a box, refusing to come out until you manually unpack it. Inspired by this answer.

Could I do something that prevents any code from running? e.g. while (true) {} // insert code here

@JAtkin No. Read the question carefully.

I can do it in 0 bytes, check out my answer :)

This is quite possible the best pop-con I have ever seen.

Are we allowed to use a language that's already unusable to begin with? (JavaScript for example)

Am I allowed to just shut off output? Then there would be no way to extrapolate any data

JavaScript Shell
This will make the language completely unusable.
clear(this);

Isn't it nice how JavaScript has such a nice function to destroy itself?

This is pretty simple, the clear function completely empty an object. this refers to the global object clearing out everything including constructors and functions.

Because this clears everything, doing anything, even defining a literal will throw an error, making the language completely useless:

*REPL environment not required.
 Uses the SpiderMonkey engine (shell not browser), the original JS engine.

That clear function seems to be a SpiderMonkey-shell-specific addition, not a generic JavaScript thing. It certainly doesn't appear in the ES5 spec § Function Properties of the Global Object. I tried this with node and got a "ReferenceError: clear is not defined". In Chrome's and Firefox's console, the clear function just clears the console, regardless of what arguments it is passed. Or perhaps the tool you used complied to a version of ECMAScript older than 5.1?

@Anko I'd specified that this is uses the SpiderMonkey engine in a footnote. I could port this to other shells considering writing clear function is pretty trivial.

Could you instead amend the statement “Isn't it nice how JavaScript has such a nice function to destroy itself”? JavaScript doesn't have that function, only the SpiderMonkey implementation does.

@Anko SpiderMonkey is JavaScript though, it comes bundled with Firefox (SpiderMonkey is Firefox's JS engine). I'll write up a version for node.js, etc. later, when I have time

I think you're confusing JavaScript (the language) with SpiderMonkey (one of the many implementations of the language). Extreme allegory: While I could write a crazy implementation of C in which all invocations of undefined behaviour result in printing the full text of the Declaration of Human Rights, I probably wouldn't be able to argue that my C submission to "golf the UDHR" that just dereferences a null pointer is a valid C solution. :)

@Anko that is pretty different imo . SpiderMonkey is a very mature and popular JS engine.

@Anko As a per site rule, a language is defined by its implementation. If an answer works consistently in at least one implementation that was published before the question, then it is acceptable. See here and here. (So the code is valid. But I'll not comment on that specific wording.)

..So, basically rm -rf?

@SIGSEGV rm -rf wouldn't affect the program being executed since most likely it would be loaded into memory by the time. Also, this is clearing the runtime environment (i.e. variables, methods) rather than the disk, so significantly less destructive

@Downgoat Nah, I meant the code rm -rf'ing itself or something

Can you write the Node.js version as you promised now?

Emmental
;#33!

I know this isn't code golf, but the right tool for the job, you know...
The user's code can be inserted after the !.
Emmental is an interesting esolang which is based on rewriting the interpreter. Every single symbol (including the built-in ones) can be redefined as an arbitrary Emmental program. The language relies on this feature so much that it doesn't provide any looping constructs. Instead, you define recursive commands which appear in their own definitions.
This redefinition happens via !, which reads a character from the stack, and then reads a string from the stack until it encounters a ;. The character is then redefined to mean the program represented by that string.
That means, we can disable Emmental's looping features by redefining ! itself as the empty program. While all other Emmental code still runs perfectly fine, and many of the criteria of a programming language are still fulfilled, it is impossible to redefine any more symbols. Without this feature (and therefore, without being able to loop), Emmental can no longer test whether a number is prime.

Disabling the single defining feature of the language: pure genius. This certainly is the right tool for the job. +1

PHP
One can completely kill PHP by setting the memory limit to 1.
It will completely die.
Try this:
<?php
    ini_set('memory_limit',1);

    //code here

This shouldn't even throw any error, since there isn't enough memory for that.
You can read more about the memory_limit directive

If the previous one is invalid, one can use output buffers:
<?php
    ob_start();

    //code here

    ob_clear();

This completely removes any output. Since the output buffer is still open, some
other things accidentally left after the code won't be shown as well.

Using @fschmengler's idea:
<?php
    define('OB_START_LEVEL', ob_get_level());
    ob_start(function(){return'';}, -1, PHP_OUTPUT_HANDLER_CLEANABLE);
    //or, for PHP <5.3:
    //ob_start(create_function('','return"";'), -1, PHP_OUTPUT_HANDLER_CLEANABLE);

    //code here

    while(ob_get_level() > OB_START_LEVEL) ob_clear();

This will avoid the problem of deleting the automatically started output buffer, used to catch the output to be compressed.
This also prevents that the output buffer is deleted or flushed (sent to the browser). To re-inforce that, an output handler is added, that always returns an empty string.
Running ob_end_flush(); echo "Hello, world!"; won't produce anything, but would send the output with a plain ob_start();.
Thanks to @LucasTrzesniewski for exposing this issue!

Since you can have severel levels of output buffering, the second one does not work. Often, while(ob_get_level()) ob_end_flush(); is used in frameworks to flush all output buffers that may have been left open accidently.

@fschmengler That will cause problems with automatically opened output buffers, usually used to compress the output using gzip. Which in turn will defeat the purpose.

This can be bypassed with: ob_end_flush(); echo "Hello, world!";

Why am I not surprised that PHP ended up towards the top of the vote-chart :)

@LucasTrzesniewski I could replace the function call using a regular expression or something. Give me a bit.

@MonkeyZeus PHP on the top? That's impossible

@LucasTrzesniewski FIXED IT!!!! Simply replaced ob_start(); with ob_start(function(){return'';}, -1, PHP_OUTPUT_HANDLER_CLEANABLE);

This shouldn't even throw any error, since there isn't enough memory for that. LOL'ed at that :)

Isn't PHP basically unusable to start off with? :P

@Orangesandlemons Depends on what you're trying to do. If you're trying to create a 500k row insertion code or some super accurate physics calculations, forget PHP. If you're going to deliver a webpage, build a desktop program, control a call center, deliver some sort of content, run JavaScript, basic image operations or even just basic scripting, PHP is fine.

@IsmaelMiguel it was a joke...

The first answer is invalid because the user code isn't actually executed.

x86 machine code in real mode (=> almost any DOS program)
00000000  6a 00 07 b9 00 04 30 c0  31 ff f3 aa              |j.....0.1...|
0000000c

i.e.
push 0
pop es
mov cx,400h
xor al,al
xor di,di
rep stosb

I hope you weren't too attached to your interrupt table.

Sir, if I may interrupt you for a few cycles so I may fini....

So what if the first instruction of my inserted code is cli, and then I fix the interrupt table, and go on to compute some primes, etc?

@NateEldredge: the next step is to jail the rest of the code to ring 3 with no trampoline back to ring 0; I'll see if I manage to put together a working example (another possibility would be to scan the whole address space and NOP-out all the cli (and inp and outp just for good measure), but I don't know if that would be allowed by the rules.

I actually thought about something a little similar.  But I wondered about that as soon as your code attempts to make its first privileged instruction, system call, etc, you'll get a trap, and then the rest of the code will not in fact execute, which the rules seem to require.  Unless you have supervisor code to manually restart at the next instruction - but then I think you have to be able to parse all instructions to determine their length, which is a pain.

At least as it stands, this won't stop a program from writing directly to the screen buffer (which was pretty common under DOS).

@JerryCoffin: of course, but any interrupt (I'm thinking keyboard and timer) should quickly break havoc.

@NateEldredge: the rules aren't really clear on this, and if you look around most answers actually consist in modifications to the environment that generate a runtime error of some type on trivial instructions (the JS clear(this);, the memory limit in PHP, the recursion limit in Python, the sandboxed environment in Python and many others), I wouldn't see this as a problem.

So this clears the interrupt table? (Not a DOS programmer!)

@kirbyfan64sos: yes; this should make a mess on all the calls to DOS and BIOS routines, plus whenever an interrupt (keyboard, timer, ...) is invoked.

I'd rather go with something like this, not rely on the first instruction executed to not be cli. This of course does have workarounds too (stack-based), but not as straightforward, and can also be circumvented by supervisor.

@NateEldredge My understanding is that that requirement is meant to prevent things like exit(0); /* insert code here */. Not all of the inserted code has to execute, and an error can occur as soon as execution starts. The system just has to try to start executing it.

I've been pondering, what would happen if the following code scanned memory to find the routines the IVT is supposed to point to. It can take as much time as it needs (we note that an IVT value of zero causes the CPU to discard the interrupt).

Java
import java.io.*;
import java.lang.reflect.*;
public class Test2 {
    public static void main(String[] args) throws Exception {
        args = new String[0];
        System.setOut(new PrintStream(new ByteArrayOutputStream()));
        System.setErr(new PrintStream(new ByteArrayOutputStream()));
        System.setIn(new ByteArrayInputStream(new byte[0]));

        Field modifiersField = Field.class.getDeclaredField("modifiers");
        modifiersField.setAccessible(true);

        Class<?> fdClass = java.io.FileDescriptor.class;
        Field outField = fdClass.getDeclaredField("out");
        outField.setAccessible(true);
        modifiersField.setInt(outField, outField.getModifiers() & ~Modifier.FINAL);
        outField.set(null, new FileDescriptor());
        Field errField = fdClass.getDeclaredField("err");
        errField.setAccessible(true);
        modifiersField.setInt(errField, errField.getModifiers() & ~Modifier.FINAL);
        errField.set(null, new FileDescriptor());
        Field inField = fdClass.getDeclaredField("in");
        inField.setAccessible(true);
        modifiersField.setInt(inField, inField.getModifiers() & ~Modifier.FINAL);
        inField.set(null, new FileDescriptor());

        System.setSecurityManager(new SecurityManager(){
            private boolean exitAllowed = false;
            public void checkPermission(java.security.Permission perm) {
                String name = perm.getName();
                if(name.equals("setIO")
                        || name.equals("setSecurityManager")
                        || name.equals("writeFileDescriptor")
                        || name.equals("readFileDescriptor")
                        || name.equals("suppressAccessChecks")
                        || (perm instanceof FilePermission
                            && name.startsWith("/proc/self/fd/"))){
                    throw new SecurityException("Nope");
                }
                if(name.startsWith("exitVM") && !exitAllowed){
                    exitAllowed = true;
                    System.exit(0);
                }
            }
            public void checkExec(String cmd){
                throw new SecurityException("nope");
            }
        });

        // program here
    }
}

Edit: Counter-countermeasures are making this giant :(
Redirects stdin and stdout to null streams and replaces args with an empty array. Also uses enormous amounts of reflection hacks to make sure the standard IO is truly hidden. Finally, it sets a security manager to make sure the standard IO can't be recreated and that makes sure programs can't set the exit code.

Negative.

Fixed @Mego

Playing with reflection is almost always reversible.

Maybe even playing with the integer cache to make math useless might be worth investigating. c:

It'd be insanely difficult to prevent any sort of operation that would output a 1 or a 2. Even Test2.class.getMethods().length would do the trick.

@VTCAKAVSMoACE I considered that but it requires the code to use Integer.valueOf or something; primitive integer operations still work.

@Mego Fixed, again

I can still work around it, at least in Linux. Here's cat: FileInputStream in = new FileInputStream("/proc/self/fd/0"); FileOutputStream out = new FileOutputStream("/proc/self/fd/1"); int b; while ((b = in.read()) != -1) out.write(b); out.close(); in.close();

You also need to add a check for "suppressAccessChecks" to disable using reflection to force the System SecurityManager field to null. But still, I'm pretty sure there's a way around it.

@PeterTaylor fixed.

@Mego Well, earlier versions of Java were notorious for security bugs but in Java 8 the SecurityManager should be solid.

Your fix is far too narrow. I just need to ungolf slightly to work around it, using File.getCanonicalPath() to resolve /proc/self and then building the paths from that.

You'd also need to clobber Runtime.exec, because otherwise I can open a shell and script obtaining the ppid and using that to get at its fds 0 and 1. But I'm not sure whether it's worth bothering with trying to fix that until the question is improved, because IMO the best way of clarifying the inconsistencies would be to prohibit stdio-breaking approaches altogether.

+1 Personally I don't consider the /proc workarounds as real deal breakers because I don't use Linux and neither my Unix OS not my Windows OS has a /proc filesystem.

You should add public void checkExec(String cmd){throw new SecurityException("nope");} to your SecurityManager to prevent Runtime.exec.

Summary of this challenge so far: 1. JavaScript, 12 chars. 2. Emmental, 6 chars. 3. x86, 12 bytes. 4. Python, 42 chars. 5. Java, 2264 chars! Why am I not surprised?

@ceasedtoturncounterclockwis Welcome to Java on PPCG

@ceasedtoturncounterclockwis It's because java is more secure so it's harder to break :D

Well, this definitely isn't golfing! :D

@numeri You don't say?

@PierreArlaud There is a simpler explanation: Java is almost always just too long to compete in a [tag:code-golf] challenge, so I won't bother with it at all.

@EriktheGolfer Naaah it's just more secure!

Snippet to replace // program here: } static { System.out.println("Hello World!"); } {. Works until Java 7 included. I think it doesn't with Java 8 anymore, but I'm not sure.

@OlivierGrégoire Works with Java 8 as well. Just tested it.

@OlivierGrégoire Can be resolved by putting the code of DankMemes inside a static block though: Copy of code in TIO.

Shhht @KevinCruijssen! You're stealing my "robbers" ideas X( But I have more, no worries :p

@OlivierGrégoire lol, I'm also working on it :) Btw, I think it should be possible to put in and out back the way it was by using reflection to enable it again, and create a FileDescriptor similar to the default one of Java's source-code.

Well, since it was beaten, I can now add a link to my answer beating it. A better way to actually avoid this kind of workaround in this answer above is to replace System with java.lang.System. But even then, there are other ways to beat this ;)

Lua
_ENV=""

In Lua, _ENV is the environment that all global variables, functions, tables, etc are stored in. Defining it to just be an empty string means you can't define anything new, and all functions and variables are wiped. This means you can not output anything, take in input, or pretty much do anything.

Does _ENV=5 work? If so, it's one character shorter.

@immibis True, but this is a popularity contest, not a code length contest. PS - Trust you to home in on the Lua answer.

+1 for Lua. Doesn't $_G=nil$ do more or less the same as well?

@Doddy Nope, because _G is just a copy of _ENV you can use to look up variables and stuff like that -  it isn't actually the environment. You could, however, do _G=nil and then set the environment to _G, and that would have the same effect.

Not entirely true. If you have a backup somewhere in local variable, you can restore it. And you can still define local variables and even call string-related functions!

Shakespeare Programming Language
Have Fun Mr Parser.

Romeo, a young man of Verona.
Juliet, a young lady of Verona.
Hamlet, another character which causes the crash.

Act I
Scene I The crash.

[Enter Romeo]
[Enter Juliet]
[Exit Hamlet]

In SPL, the built in parser which is downloaded with the program follows very specific rules as to what can happen in the script. One of such rules is that only two characters can be on stage at once. Also, making a character exit the stage who was never on stage will confuse it. The same goes for adding a character to the stage who is already on stage. When the parser receives an error, it will refuse to do ANYTHING else; you literally have to completely shutdown the program and the parser and then start up everything again.
P.S. If you have no idea how this language works, Google it. It's awesome.

So, is it a parse error or a runtime error?

@fschmengler That is basically the same thing for interpreted languages.

If I add code after the last line, will it actually execute though?

@Sp3000 It will certainly try......it will appear as though nothing out of the ordinary has happened...until the parser crashes. :)

Smalltalk
I'm not sure if this qualifies:
Smalltalk := Nil.

This deletes the entire run-time environment, hanging the object engine. The only way to fix this is to forcibly terminate the process and restart from backup.
For those that don't know, the way [Visual Works] Smalltalk works is slightly weird. It's like a mini-OS. When you start Smalltalk, you load a "memory image" into RAM, and it continues executing from where it left off. The entire Smalltalk IDE is written in Smalltalk and is dynamically modifiable.
In particular, Smalltalk is a dictionary containing all global variables. Most particularly, every time you declare a new class, a global variable with that name is created, pointing to the Class object for your new class. So setting Smalltalk to Nil (basically null) deletes all classes in the entire system. Even the GUI event handlers go poof.
I have no idea why this variable is even writable. Probably because it's a global variable, and therefore exists as an entry inside itself. (Does your head hurt yet? Did I mention that every object has a class, and classes are objects, so every class has a class? The class of a class is called a metaclass, but a metaclass is also an object, which therefore has a class...)
You could probably achieve a similar effect by clearing the dictionary rather than replacing it with null. Indeed, there's any number of things you could code to delete all the classes in the system, leaving you unable to do anything. But since the actual Smalltalk compiler is also a class... anything that breaks the language also kinda breaks the entire IDE, so...

It is invalid if it hangs itself, but not the next command. But I'm curious: Does it have a class that can have both values being a class and being an ordinary object? And a class that can have both of those values and this new class? And a class of itself?

A Smalltalk class is vaguely like a JavaScript prototype. By hacking the system classes hard enough, you can even turn Smalltalk into a multiple-inheritance language. Also, method calls are objects, code blocks are objects... you can intercept undefined method calls and make them do stuff... it's a very dynamic language. Everything is an object! Including the IDE...

Had to use nil instead of Nil in Pharo.

Another one is true become: false, but I think this doesn't work in newer versions of the language. You could kill SmallTalk/V 286 this way.

@YiminRong Oh man, yeah - you could do some evil stuff with #become:...

“Did I mention that every object has a class, and classes are objects, so every class has a class? The class of a class is called a metaclass, but a metaclass is also an object, which therefore has a class...” As a Pythonista, my head doesn't hurt at all. On the contrary, I think I'd feel right at home with Smalltalk.

PostScript
Yes, PostScript is a programming language. Moreover, it's a programming language where all language constructs are system-defined functions, which can be redefined...
/Magic 1000 dict def
systemdict {pop Magic exch {} put} forall
Magic begin

In English:

Create an empty 1,000-element dictionary and name it Magic.
For every key in systemdict, add the same key to Magic, with an empty definition ("{}").
Push Magic onto the top of the dictionary stack.

From this moment on, every PostScript language command is defined to do nothing. AFAIK, it is impossible to escape from this condition.
(Technically, you're not "destroying" the old definitions, you're just shadowing them. If you could still execute end, that would pop Magic off the dictionary stack, un-shadowing all the commands and giving you your life back. But since end itself is also shadowed... it will do nothing now.)
Note that all commands will still execute... it's just that now they are defined to do nothing. You won't get any kind of error, it's just that nothing will happen. (Well, I suppose stack overflow will happen eventually...)

This is actually kinda funny... and also scary...

It has been years and 43 up votes and no one pointed this out which makes me suspect the problem is on my side.  Anyway, I am using GPL Ghostscript 9.53.3 (2020-10-01) and I get Error: /undefined in Magic.  It looks like the first line should be /Magic 1000 dict def.  The signature is key value def -, according to Page 568 of the manual.

@7h3yskr8 My word... you're right. Not sure how I fluffed that up.

Haskell
There are a couple of possibilities here.
Boring idea #1: Define main to do nothing. Now no matter what other code you write, it can never execute. (Unless you manually run it from the REPL.)
Boring idea #2: Define a module with no public exports. Now no matter what other code your write, it can never execute.
Interesting idea: Disable all imports.
module Fubar where
import Prelude ()
foo = foo
-- More code here.

Now you can define functions which are visible and can be run... but they can't do anything. All standard Haskell types and functions are now hidden. (With the exception of a few things really deeply hard-wired into the language.)
Most particularly, you cannot perform any I/O whatsoever. You also cannot do machine-precision arithmetic. (Since Int, Double, etc are now undefined.)
You can still write lambda-calculus functions that do perform some real computation though. You just can't get any data into or out of the thing. But you could of course write another, separate module that calls the Fubar module above and does I/O on its behalf (thus proving that the code does execute and does do stuff).
Some subtleties:

The dummy foo = foo declaration is needed to prevent anybody adding additional imports. (Imports cannot appear after declarations.)

There are various non-standard Haskell language extensions that would enable you to climb out of this situation. But language extensions have to be switched on with a compiler pragma at the top of the file. (Or with a command-line switch to the compiler. I can't really prevent that one!)

-0.1 Use foobar, the spelling you used has some... unintended connotations.

@wizzwizz4 I'm pretty sure "foobar" is just "fubar" prettied up to avoid censors. That's why I tend to avoid it in programming examples.

@jpmc26 It actually has a long and distinguished history, going through an MIT model trains group, being popularised in a programming book before being incorporated into documentation, then being brought into popular culture. I'm pretty sure it's a coincidence.

Both "boring ideas" are invalid because the user code isn't actually executed. (The "interesting idea" seems to be valid, though)

Any program executing under Linux/x86(-64)
This program is written in C, but it can disrupt execution of any program running under Linux/x86 (-32 or -64).  You prepend it to the command-line invocation of the program you want to disrupt.
It uses the debugger API to prevent the target program from producing any output.  Specifically, all of the system calls that can communicate something to the world outside the process (most obviously write, of course, but also open when creating a file, the bulk of the socket API, kill when applied to another process, ...) will fail as if they were unimplemented. _exit is allowed, but the exit code is overwritten with a zero.
Unlike the previous edition of this answer, many programs can run nearly to completion under these conditions; it's just that all their work is wasted.  For instance, if you do ./no-syscalls /bin/ls (assuming GNU coreutils ls) it reads the whole directory and formats it, and then all the write calls to produce output fail.  (Anything that needs to open a bidirectional communication channel, though, such as all X11 clients, will fail at that point.  I thought about allowing socket but not send, but it seemed too likely to open loopholes.)
There are several command-line options to tweak the behavior;
-a  log allowed system calls
-d  log denied system calls
-e  deny everything, not just output
-S  permit writes to stderr

Dynamically linked programs will not even get out of the dynamic linker in -e mode.  -S obviously opens a huge hole in the policy, but it can be  entertaining to watch programs moan about nothing working, e.g.
$ ./no-syscalls -daeS /bin/ls
syscall 59...
syscall 59 = 0
syscall 12 (denied) = -38
syscall 21 (denied) = -38
syscall 9 (denied) = -38
syscall 20...
/bin/ls: error while loading shared libraries: cannot create cache for search path: Cannot allocate memory
syscall 20 = 107
syscall 231...
Program exited, status = 0

You have to read log output with /usr/include/asm*/unistd.h open in another window, because this is already quite long enough.
Sadly, the debugger interfaces that this uses are only weakly consistent across Unix implementations, and are intrinsically CPU-specific.  It would be relatively straightforward to port it to other CPU architectures (just add appropriate definitions of SYSCALL_*_REG), and it's probably possible to port it to any Unix that has ptrace, but you might need to muck with the syscall whitelist extensively as well as dealing with divergences in ptrace.

#define _GNU_SOURCE 1
#include <stddef.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <sys/ptrace.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/user.h>
#include <sys/wait.h>
#include <errno.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#if defined __linux__
# define SYS_unimplemented -1L
# if defined __i386__
#  define SYSCALL_NUMBER_REG regs.orig_eax
#  define SYSCALL_ARG1_REG   regs.ebx
#  define SYSCALL_ARG2_REG   regs.ecx
#  define SYSCALL_ARG3_REG   regs.edx
#  define SYSCALL_ARG4_REG   regs.esi
#  define SYSCALL_RESULT_REG regs.eax
# elif defined __x86_64__
#  define SYSCALL_NUMBER_REG regs.orig_rax
#  define SYSCALL_ARG1_REG   regs.rdi
#  define SYSCALL_ARG2_REG   regs.rsi
#  define SYSCALL_ARG3_REG   regs.rdx
#  define SYSCALL_ARG4_REG   regs.r10
#  define SYSCALL_RESULT_REG regs.rax
# else
#  error "Need to know system call convention for this CPU"
# endif
#else
# error "Need to know system call convention for this OS"
#endif

static long
xptrace(int request, pid_t pid, void *addr, void *data)
{
  errno = 0;
  long rv = ptrace(request, pid, addr, data);
  if (rv == -1 && errno) {
    perror("ptrace");
    if (pid != 0) kill(pid, SIGKILL);
    exit(1);
  }
  return rv;
}
#define GET_REG_(pid, x) \
  xptrace(PTRACE_PEEKUSER, pid, (void*)offsetof(struct user, x), 0)
#define GET_REG(pid, x) GET_REG_(pid, SYSCALL_##x##_REG)
#define SET_REG_(pid, x, v) \
  xptrace(PTRACE_POKEUSER, pid, (void*)offsetof(struct user, x), (void*)v)
#define SET_REG(pid, x, v) SET_REG_(pid, SYSCALL_##x##_REG, v)

/* This function defines the system-call policy.  */
static int
deny_syscall(pid_t pid, int scnum, int deny_all, int allow_stderr)
{
  switch (scnum) {
  /* These syscalls are unconditionally allowed (when not in -e mode);
     they perform input, or change only process-local state. */
#ifdef SYS_access
  case SYS_access:
#endif
#ifdef SYS_alarm
  case SYS_alarm:
#endif
#ifdef SYS_arch_prctl
  case SYS_arch_prctl:
#endif
#ifdef SYS_brk
  case SYS_brk:
#endif
#ifdef SYS_capget
  case SYS_capget:
#endif
#ifdef SYS_clock_getres
  case SYS_clock_getres:
#endif
#ifdef SYS_clock_gettime
  case SYS_clock_gettime:
#endif
#ifdef SYS_clock_nanosleep
  case SYS_clock_nanosleep:
#endif
#ifdef SYS_close
  case SYS_close:
#endif
#ifdef SYS_dup
  case SYS_dup:
#endif
#ifdef SYS_dup2
  case SYS_dup2:
#endif
#ifdef SYS_dup3
  case SYS_dup3:
#endif
#ifdef SYS_epoll_create
  case SYS_epoll_create:
#endif
#ifdef SYS_epoll_create1
  case SYS_epoll_create1:
#endif
#ifdef SYS_epoll_ctl
  case SYS_epoll_ctl:
#endif
#ifdef SYS_epoll_ctl_old
  case SYS_epoll_ctl_old:
#endif
#ifdef SYS_epoll_pwait
  case SYS_epoll_pwait:
#endif
#ifdef SYS_epoll_wait
  case SYS_epoll_wait:
#endif
#ifdef SYS_epoll_wait_old
  case SYS_epoll_wait_old:
#endif
#ifdef SYS_eventfd
  case SYS_eventfd:
#endif
#ifdef SYS_eventfd2
  case SYS_eventfd2:
#endif
#ifdef SYS_faccessat
  case SYS_faccessat:
#endif
#ifdef SYS_fadvise64
  case SYS_fadvise64:
#endif
#ifdef SYS_fadvise64_64
  case SYS_fadvise64_64:
#endif
#ifdef SYS_fanotify_init
  case SYS_fanotify_init:
#endif
#ifdef SYS_fanotify_mark
  case SYS_fanotify_mark:
#endif
#ifdef SYS_fgetxattr
  case SYS_fgetxattr:
#endif
#ifdef SYS_flistxattr
  case SYS_flistxattr:
#endif
#ifdef SYS_fstat
  case SYS_fstat:
#endif
#ifdef SYS_fstat64
  case SYS_fstat64:
#endif
#ifdef SYS_fstatat64
  case SYS_fstatat64:
#endif
#ifdef SYS_fstatfs
  case SYS_fstatfs:
#endif
#ifdef SYS_fstatfs64
  case SYS_fstatfs64:
#endif
#ifdef SYS_ftime
  case SYS_ftime:
#endif
#ifdef SYS_futex
  case SYS_futex:
#endif
#ifdef SYS_getcpu
  case SYS_getcpu:
#endif
#ifdef SYS_getcwd
  case SYS_getcwd:
#endif
#ifdef SYS_getdents
  case SYS_getdents:
#endif
#ifdef SYS_getdents64
  case SYS_getdents64:
#endif
#ifdef SYS_getegid
  case SYS_getegid:
#endif
#ifdef SYS_getegid32
  case SYS_getegid32:
#endif
#ifdef SYS_geteuid
  case SYS_geteuid:
#endif
#ifdef SYS_geteuid32
  case SYS_geteuid32:
#endif
#ifdef SYS_getgid
  case SYS_getgid:
#endif
#ifdef SYS_getgid32
  case SYS_getgid32:
#endif
#ifdef SYS_getgroups
  case SYS_getgroups:
#endif
#ifdef SYS_getgroups32
  case SYS_getgroups32:
#endif
#ifdef SYS_getitimer
  case SYS_getitimer:
#endif
#ifdef SYS_get_kernel_syms
  case SYS_get_kernel_syms:
#endif
#ifdef SYS_get_mempolicy
  case SYS_get_mempolicy:
#endif
#ifdef SYS_getpeername
  case SYS_getpeername:
#endif
#ifdef SYS_getpgid
  case SYS_getpgid:
#endif
#ifdef SYS_getpgrp
  case SYS_getpgrp:
#endif
#ifdef SYS_getpid
  case SYS_getpid:
#endif
#ifdef SYS_getpmsg
  case SYS_getpmsg:
#endif
#ifdef SYS_getppid
  case SYS_getppid:
#endif
#ifdef SYS_getpriority
  case SYS_getpriority:
#endif
#ifdef SYS_getrandom
  case SYS_getrandom:
#endif
#ifdef SYS_getresgid
  case SYS_getresgid:
#endif
#ifdef SYS_getresgid32
  case SYS_getresgid32:
#endif
#ifdef SYS_getresuid
  case SYS_getresuid:
#endif
#ifdef SYS_getresuid32
  case SYS_getresuid32:
#endif
#ifdef SYS_getrlimit
  case SYS_getrlimit:
#endif
#ifdef SYS_get_robust_list
  case SYS_get_robust_list:
#endif
#ifdef SYS_getrusage
  case SYS_getrusage:
#endif
#ifdef SYS_getsid
  case SYS_getsid:
#endif
#ifdef SYS_getsockname
  case SYS_getsockname:
#endif
#ifdef SYS_getsockopt
  case SYS_getsockopt:
#endif
#ifdef SYS_get_thread_area
  case SYS_get_thread_area:
#endif
#ifdef SYS_gettid
  case SYS_gettid:
#endif
#ifdef SYS_gettimeofday
  case SYS_gettimeofday:
#endif
#ifdef SYS_getuid
  case SYS_getuid:
#endif
#ifdef SYS_getuid32
  case SYS_getuid32:
#endif
#ifdef SYS_getxattr
  case SYS_getxattr:
#endif
#ifdef SYS_inotify_add_watch
  case SYS_inotify_add_watch:
#endif
#ifdef SYS_inotify_init
  case SYS_inotify_init:
#endif
#ifdef SYS_inotify_init1
  case SYS_inotify_init1:
#endif
#ifdef SYS_inotify_rm_watch
  case SYS_inotify_rm_watch:
#endif
#ifdef SYS_ioprio_get
  case SYS_ioprio_get:
#endif
#ifdef SYS_kcmp
  case SYS_kcmp:
#endif
#ifdef SYS_lgetxattr
  case SYS_lgetxattr:
#endif
#ifdef SYS_listxattr
  case SYS_listxattr:
#endif
#ifdef SYS_llistxattr
  case SYS_llistxattr:
#endif
#ifdef SYS_lookup_dcookie
  case SYS_lookup_dcookie:
#endif
#ifdef SYS_lseek
  case SYS_lseek:
#endif
#ifdef SYS_lstat
  case SYS_lstat:
#endif
#ifdef SYS_lstat64
  case SYS_lstat64:
#endif
#ifdef SYS_madvise
  case SYS_madvise:
#endif
#ifdef SYS_mbind
  case SYS_mbind:
#endif
#ifdef SYS_mincore
  case SYS_mincore:
#endif
#ifdef SYS_mlock
  case SYS_mlock:
#endif
#ifdef SYS_mlockall
  case SYS_mlockall:
#endif
#ifdef SYS_mprotect
  case SYS_mprotect:
#endif
#ifdef SYS_mremap
  case SYS_mremap:
#endif
#ifdef SYS_munlock
  case SYS_munlock:
#endif
#ifdef SYS_munlockall
  case SYS_munlockall:
#endif
#ifdef SYS_munmap
  case SYS_munmap:
#endif
#ifdef SYS_name_to_handle_at
  case SYS_name_to_handle_at:
#endif
#ifdef SYS_nanosleep
  case SYS_nanosleep:
#endif
#ifdef SYS_newfstatat
  case SYS_newfstatat:
#endif
#ifdef SYS_nice
  case SYS_nice:
#endif
#ifdef SYS_oldfstat
  case SYS_oldfstat:
#endif
#ifdef SYS_oldlstat
  case SYS_oldlstat:
#endif
#ifdef SYS_oldolduname
  case SYS_oldolduname:
#endif
#ifdef SYS_oldstat
  case SYS_oldstat:
#endif
#ifdef SYS_olduname
  case SYS_olduname:
#endif
#ifdef SYS_pause
  case SYS_pause:
#endif
#ifdef SYS_perf_event_open
  case SYS_perf_event_open:
#endif
#ifdef SYS_personality
  case SYS_personality:
#endif
#ifdef SYS_pivot_root
  case SYS_pivot_root:
#endif
#ifdef SYS_poll
  case SYS_poll:
#endif
#ifdef SYS_ppoll
  case SYS_ppoll:
#endif
#ifdef SYS_prctl
  case SYS_prctl:
#endif
#ifdef SYS_pread64
  case SYS_pread64:
#endif
#ifdef SYS_preadv
  case SYS_preadv:
#endif
#ifdef SYS_prlimit64
  case SYS_prlimit64:
#endif
#ifdef SYS_pselect6
  case SYS_pselect6:
#endif
#ifdef SYS_query_module
  case SYS_query_module:
#endif
#ifdef SYS_read
  case SYS_read:
#endif
#ifdef SYS_readahead
  case SYS_readahead:
#endif
#ifdef SYS_readdir
  case SYS_readdir:
#endif
#ifdef SYS_readlink
  case SYS_readlink:
#endif
#ifdef SYS_readlinkat
  case SYS_readlinkat:
#endif
#ifdef SYS_readv
  case SYS_readv:
#endif
#ifdef SYS_recvfrom
  case SYS_recvfrom:
#endif
#ifdef SYS_recvmmsg
  case SYS_recvmmsg:
#endif
#ifdef SYS_recvmsg
  case SYS_recvmsg:
#endif
#ifdef SYS_remap_file_pages
  case SYS_remap_file_pages:
#endif
#ifdef SYS_request_key
  case SYS_request_key:
#endif
#ifdef SYS_restart_syscall
  case SYS_restart_syscall:
#endif
#ifdef SYS_rt_sigaction
  case SYS_rt_sigaction:
#endif
#ifdef SYS_rt_sigpending
  case SYS_rt_sigpending:
#endif
#ifdef SYS_rt_sigprocmask
  case SYS_rt_sigprocmask:
#endif
#ifdef SYS_rt_sigreturn
  case SYS_rt_sigreturn:
#endif
#ifdef SYS_rt_sigsuspend
  case SYS_rt_sigsuspend:
#endif
#ifdef SYS_rt_sigtimedwait
  case SYS_rt_sigtimedwait:
#endif
#ifdef SYS_sched_getaffinity
  case SYS_sched_getaffinity:
#endif
#ifdef SYS_sched_getattr
  case SYS_sched_getattr:
#endif
#ifdef SYS_sched_getparam
  case SYS_sched_getparam:
#endif
#ifdef SYS_sched_get_priority_max
  case SYS_sched_get_priority_max:
#endif
#ifdef SYS_sched_get_priority_min
  case SYS_sched_get_priority_min:
#endif
#ifdef SYS_sched_getscheduler
  case SYS_sched_getscheduler:
#endif
#ifdef SYS_sched_rr_get_interval
  case SYS_sched_rr_get_interval:
#endif
#ifdef SYS_sched_setaffinity
  case SYS_sched_setaffinity:
#endif
#ifdef SYS_sched_setattr
  case SYS_sched_setattr:
#endif
#ifdef SYS_sched_setparam
  case SYS_sched_setparam:
#endif
#ifdef SYS_sched_setscheduler
  case SYS_sched_setscheduler:
#endif
#ifdef SYS_sched_yield
  case SYS_sched_yield:
#endif
#ifdef SYS_select
  case SYS_select:
#endif
#ifdef SYS_setfsgid
  case SYS_setfsgid:
#endif
#ifdef SYS_setfsgid32
  case SYS_setfsgid32:
#endif
#ifdef SYS_setfsuid
  case SYS_setfsuid:
#endif
#ifdef SYS_setfsuid32
  case SYS_setfsuid32:
#endif
#ifdef SYS_setgid
  case SYS_setgid:
#endif
#ifdef SYS_setgid32
  case SYS_setgid32:
#endif
#ifdef SYS_setgroups
  case SYS_setgroups:
#endif
#ifdef SYS_setgroups32
  case SYS_setgroups32:
#endif
#ifdef SYS_setitimer
  case SYS_setitimer:
#endif
#ifdef SYS_setns
  case SYS_setns:
#endif
#ifdef SYS_setpgid
  case SYS_setpgid:
#endif
#ifdef SYS_setpriority
  case SYS_setpriority:
#endif
#ifdef SYS_setregid
  case SYS_setregid:
#endif
#ifdef SYS_setregid32
  case SYS_setregid32:
#endif
#ifdef SYS_setresgid
  case SYS_setresgid:
#endif
#ifdef SYS_setresgid32
  case SYS_setresgid32:
#endif
#ifdef SYS_setresuid
  case SYS_setresuid:
#endif
#ifdef SYS_setresuid32
  case SYS_setresuid32:
#endif
#ifdef SYS_setreuid
  case SYS_setreuid:
#endif
#ifdef SYS_setreuid32
  case SYS_setreuid32:
#endif
#ifdef SYS_setrlimit
  case SYS_setrlimit:
#endif
#ifdef SYS_set_robust_list
  case SYS_set_robust_list:
#endif
#ifdef SYS_setsid
  case SYS_setsid:
#endif
#ifdef SYS_set_thread_area
  case SYS_set_thread_area:
#endif
#ifdef SYS_set_tid_address
  case SYS_set_tid_address:
#endif
#ifdef SYS_setuid
  case SYS_setuid:
#endif
#ifdef SYS_setuid32
  case SYS_setuid32:
#endif
#ifdef SYS_sigaction
  case SYS_sigaction:
#endif
#ifdef SYS_sigaltstack
  case SYS_sigaltstack:
#endif
#ifdef SYS_signal
  case SYS_signal:
#endif
#ifdef SYS_signalfd
  case SYS_signalfd:
#endif
#ifdef SYS_signalfd4
  case SYS_signalfd4:
#endif
#ifdef SYS_sigpending
  case SYS_sigpending:
#endif
#ifdef SYS_sigprocmask
  case SYS_sigprocmask:
#endif
#ifdef SYS_sigreturn
  case SYS_sigreturn:
#endif
#ifdef SYS_sigsuspend
  case SYS_sigsuspend:
#endif
#ifdef SYS_socketpair
  case SYS_socketpair:
#endif
#ifdef SYS_stat
  case SYS_stat:
#endif
#ifdef SYS_stat64
  case SYS_stat64:
#endif
#ifdef SYS_statfs
  case SYS_statfs:
#endif
#ifdef SYS_statfs64
  case SYS_statfs64:
#endif
#ifdef SYS_sysfs
  case SYS_sysfs:
#endif
#ifdef SYS_sysinfo
  case SYS_sysinfo:
#endif
#ifdef SYS_time
  case SYS_time:
#endif
#ifdef SYS_timer_create
  case SYS_timer_create:
#endif
#ifdef SYS_timer_delete
  case SYS_timer_delete:
#endif
#ifdef SYS_timerfd_create
  case SYS_timerfd_create:
#endif
#ifdef SYS_timerfd_gettime
  case SYS_timerfd_gettime:
#endif
#ifdef SYS_timerfd_settime
  case SYS_timerfd_settime:
#endif
#ifdef SYS_timer_getoverrun
  case SYS_timer_getoverrun:
#endif
#ifdef SYS_timer_gettime
  case SYS_timer_gettime:
#endif
#ifdef SYS_timer_settime
  case SYS_timer_settime:
#endif
#ifdef SYS_times
  case SYS_times:
#endif
#ifdef SYS_ugetrlimit
  case SYS_ugetrlimit:
#endif
#ifdef SYS_ulimit
  case SYS_ulimit:
#endif
#ifdef SYS_umask
  case SYS_umask:
#endif
#ifdef SYS_uname
  case SYS_uname:
#endif
#ifdef SYS_unshare
  case SYS_unshare:
#endif
#ifdef SYS_uselib
  case SYS_uselib:
#endif
#ifdef SYS_ustat
  case SYS_ustat:
#endif
#ifdef SYS_wait4
  case SYS_wait4:
#endif
#ifdef SYS_waitid
  case SYS_waitid:
#endif
#ifdef SYS_waitpid
  case SYS_waitpid:
#endif
    return deny_all;

#ifdef SYS_exit
  case SYS_exit:
#endif
#ifdef SYS_exit_group
  case SYS_exit_group:
#endif
    /* Special case: exiting is allowed, even in -e mode,
       but the exit status is forced to 0. */
    SET_REG(pid, ARG1, 0);
    return 0;

#ifdef SYS_fcntl
  case SYS_fcntl:
#endif
#ifdef SYS_fcntl64
  case SYS_fcntl64:
#endif
    /* Special case: fcntl is allowed, but only for the *FD and *FL
       operations.  This is a compromise between not allowing it at
       all, which would break some interpreters, and trying to go
       through the dozens of extended ops and figure out which ones
       can affect global state.  */
    {
      int cmd = GET_REG(pid, ARG2);
      if (cmd == F_DUPFD || cmd == F_DUPFD_CLOEXEC ||
          cmd == F_GETFD || cmd == F_SETFD || cmd == F_SETFL || cmd == F_GETFL)
        return deny_all;
    }
    return 1;

#ifdef SYS_kill
  case SYS_kill:
#endif
#ifdef SYS_rt_sigqueueinfo
  case SYS_rt_sigqueueinfo:
#endif
#ifdef SYS_rt_tgsigqueueinfo
  case SYS_rt_tgsigqueueinfo:
#endif
#ifdef SYS_tkill
  case SYS_tkill:
#endif
#ifdef SYS_tgkill
  case SYS_tgkill:
#endif
    /* Special case: kill is allowed if and only if directed to the calling
       process. */
    {
      pid_t kpid = GET_REG(pid, ARG1);
      if (kpid == pid)
        return deny_all;
    }
    return 1;

#ifdef SYS_mmap
  case SYS_mmap:
#endif
#ifdef SYS_mmap2
  case SYS_mmap2:
#endif
    /* Special case: mmap is allowed if it is private or read-only.  */
    {
      int prot  = GET_REG(pid, ARG3);
      int flags = GET_REG(pid, ARG4);
      if ((flags & (MAP_SHARED|MAP_PRIVATE)) == MAP_PRIVATE)
        return deny_all;
      if (!(prot & PROT_WRITE))
        return deny_all;
    }
    return 1;

    /* Special case: open() variants are allowed only if read-only and
       not creating. */
#ifdef SYS_open
  case SYS_open:
#endif
#ifdef SYS_openat
  case SYS_openat:
#endif
#ifdef SYS_open_by_handle_at
  case SYS_open_by_handle_at:
#endif
    {
      int flags = ((scnum == SYS_open)
                   ? GET_REG(pid, ARG2)
                   : GET_REG(pid, ARG3));
      if (!(flags & O_CREAT) && ((flags & O_ACCMODE) == O_RDONLY))
        return deny_all;
    }
    return 1;

#ifdef SYS_write
  case SYS_write:
#endif
#ifdef SYS_write64
  case SYS_write64:
#endif
#ifdef SYS_writev
  case SYS_writev:
#endif
#ifdef SYS_pwrite
  case SYS_pwrite:
#endif
#ifdef SYS_pwrite64
  case SYS_pwrite64:
#endif
#ifdef SYS_pwritev
  case SYS_pwritev:
#endif
    /* Special case: optionally, the program is allowed to write to
       stderr.  This opens a gaping hole in the policy, but it can be
       quite entertaining to watch programs moan about how nothing works. */
    if (allow_stderr) {
      int fd = GET_REG(pid, ARG1);
      if (fd == 2)
        return 0;
    }
    return 1;

  default:
    /* All other system calls are unconditionally denied. */
    return 1;
  }
}

static void
usage(char *progname)
{
  fprintf(stderr, "usage: %s [-adeS] program args...\n", progname);
  fputs("\t-a  log allowed system calls\n"
        "\t-d  log denied system calls\n"
        "\t-e  deny everything, not just output\n"
        "\t-S  permit writes to stderr\n", stderr);
  exit(2);
}

int
main(int argc, char **argv)
{
  pid_t pid;
  int   status;
  int   opt;
  long  last_syscall = SYS_unimplemented;
  int   last_allowed = 0;
  int   after_execve = 0;
  int   trace_active = 0;
  int   allow_stderr = 0;
  int   deny_all     = 0;
  int   log_allowed  = 0;
  int   log_denied   = 0;

  while ((opt = getopt(argc, argv, "+adeS")) != -1) {
    switch (opt) {
    case 'a': log_allowed  = 1; break;
    case 'd': log_denied   = 1; break;
    case 'e': deny_all     = 1; break;
    case 'S': allow_stderr = 1; break;
    default:
      usage(argv[0]);
    }
  }
  if (optind == argc) {
    usage(argv[0]);
  }

  setvbuf(stdout, 0, _IOLBF, 0);
  setvbuf(stderr, 0, _IOLBF, 0);

  pid = fork();
  if (pid == -1) {
    perror("fork");
    exit(1);

  } else if (pid == 0) {
    raise(SIGSTOP); /* synch with parent */
    execvp(argv[optind], argv+optind);
    perror("execvp");
    exit(1);
  }

  /* If we get here, we are the parent. */
  for (;;) {
    pid_t rv = waitpid(pid, &status, WUNTRACED);
    if (rv != pid) {
      perror("waitpid");
      kill(pid, SIGKILL);
      exit(1);
    }
    if (!WIFSTOPPED(status)) {
      if (WIFEXITED(status))
        printf("Program exited, status = %d\n", WEXITSTATUS(status));
      else if (WIFSIGNALED(status))
        printf("Program killed by signal %d\n", WTERMSIG(status));
      else {
        printf("Un-decodable status %04x\n", status);
        kill(pid, SIGKILL); /* just in case */
      }
      exit(0);
    }
    if (WSTOPSIG(status) == SIGSTOP && !trace_active) {
      /* This is the raise(SIGSTOP) on the child side of the fork. */
      trace_active = 1;
      xptrace(PTRACE_SEIZE, pid, 0, (void*)PTRACE_O_TRACESYSGOOD);
      xptrace(PTRACE_SYSCALL, pid, 0, 0);
    }
    else if (WSTOPSIG(status) == (SIGTRAP|0x80)) {
      if (last_syscall == SYS_unimplemented) {
        last_syscall = GET_REG(pid, NUMBER);
        /* The child process is allowed to execute normally until an
           execve() succeeds.  */
        if (after_execve && deny_syscall(pid, last_syscall,
                                         deny_all, allow_stderr)) {
          last_allowed = 0;
          SET_REG(pid, NUMBER, SYS_unimplemented);
        } else {
          last_allowed = 1;
          if (log_allowed) {
            /* Log this now, we may not get another chance. */
            printf("syscall %ld...\n", last_syscall);
          }
        }
      } else {
        if (last_allowed ? log_allowed : log_denied) {
          long scret = GET_REG(pid, RESULT);
          printf("syscall %ld%s = %ld\n",
                 last_syscall, last_allowed ? "" : " (denied)", scret);
        }
        if (last_allowed && (last_syscall == SYS_execve ||
                             last_syscall == SYS_execveat)) {
          long scret = GET_REG(pid, RESULT);
          if (scret == 0)
            after_execve = 1;
        }
        last_syscall = SYS_unimplemented;
      }
      xptrace(PTRACE_SYSCALL, pid, 0, 0);
    }
    else if (WSTOPSIG(status) == SIGTRAP) {
      /* Swallow all SIGTRAPs, they are probably spurious debug events. */
      xptrace(PTRACE_SYSCALL, pid, 0, 0);
    } else {
      /* Allow all normal signals to proceed unmolested. */
      if (log_allowed) {
        printf("process received signal %d\n", WSTOPSIG(status));
      }
      xptrace(PTRACE_SYSCALL, pid, 0, (void*)(uintptr_t)WSTOPSIG(status));
    }
  }
}

“the target can read its command-line arguments, perform pure computations, and produce an 8-bit exit status, but will not be able to allocate memory or do I/O”—I dunno, I think you still meet the four criteria. Integers can be interpreted from commandline arguments; the exit status can be leveraged for simple output; addition isn't hindered; and all you need for a primality test is the ability to do pure computations, a bit of stack space, and a loop.

@BlacklightShining I think that this accomplishes such a huge restriction relative to normal behavior that it should be acceptable even though, as you say, you could still write a prime tester, but -DNO_EXIT mode is for people who feel as you do.  No meaningful output is possible in that mode.

…oh, I missed that. With -DNO_EXIT, this does break the language. Can't change my vote without an edit, though…

@BlacklightShining I thought about it some more and I rewrote the program basically from scratch.  It's rather cleverer now what it does and (I hope) meets even the most stringent reading of the challenge.

I can generate output with this. I write to my command line. The output is visible in ps!

@Joshua That's clever, and would be difficult to prevent using this approach (since the program is just modifying its own memory) but it's not currently on the list of "allowed output methods."

Note that this program only meets the spec if -e is specified and no other options. If -a or -d is specified, the log of allowed or denied syscalls can be used as an output form. If -e isn't specified, a binary exitcode-like output is allowed by either killing itself with kill() or using exit(), which would produce two different exit codes.

You know, I think this could actually be used to debug syscalls or programs that directly use them.

@JesseTG Are you familiar with strace?

Can the program die by SIGSEGV and SIGILL?  This would allow the program to give a single binary output.

TeX
\catcode`\\=10

I'm not sure this will actually work, but in theory this should break \ as escape character leaving you no way to fix it. Normally TeX can read and write files, now it can't write anything that depends on logic. Thus the language is now broken as defined by OP.
EDIT:
Other kill commands taken from the comments (although both might violate the code-must-be-executed rule):

\def\fi{}\iffalse by smpl creates an un-closable if branch
\catcode13=9% by iwillnotexist idonotexist creates a never-ending comment

Only true for formats that use \ as the only character in category 0, but glad to see TeX represented here! :)

Well, you can still output anything. Appending 20 paragraphs of Lorem Ipsum to your code, I get about 7 pages of nicely typeset text. The problem is that I have to kill it; but still, the DVI file is already shipped, at least partially.

It is no longer possible to produce different outputs. Thus, per definition in the question, the language is broken.

A better version: \def\fi{}\iffalse. I can't post answers on this because it requires at least 10 rep earned from this site, but this will not allow output anymore too.

@smpl you can still redefine \fi to its original meaning, right? Thus the language is not broken beyond any repair.

@Cephalopod \fi is a TeX primitive. And no you can't redefine anything at this point, \iffalse has been called.

@smpl Hmm, I see. Very clever.

+1. I just started teaching myself out of the TeXBook and when I realized \catcode13=9% would completely break the language (Everything after % is commented and newlines (ASCII char 13) are ignored, so the comment extends to infinity) I wanted to post it here. But you have a slightly longer command already in here.

@IwillnotexistIdonotexist That wouldn't be a valid submission because it creates an infinite comment, and comments aren't code so aren't "executed".

@wizzwizz4 But the rules say "The inserted code must be actually executed, in a way it is supposed to satisfy the criteria.". The inserted code is \catcode13=9% and really is executed. It's not akin to commenting // or /* in C & C++ because neither continues ad infinitum (/* is closed by the next */ so it doesn't make the language useless), and \n in the source files of those languages cannot be reconsidered as a normal character. Only TeX allows this sort of control over the lexer system, enabling this hack.

@IwillnotexistIdonotexist No, the inserted code is user-defined. See the PHP answer below: // insert program here.

Scratch

The when [timer v] > (0) will run as soon as the code is initialised, which if you're in the editor is before you even start the code. The when I receive (join[][]) will cause an error to be thrown every time anything is broadcast, pausing code execution if you have Developer version of Flash. The break function will create clones, and trigger the broadcast error. Every single clone will last two seconds then delete itself, putting strain on the stack. And every clone will respond to the when [timer v] > (0), running the break subroutine and resetting the timer, which causes the timer code to be run again. Also, each clone will respond to every broadcast error as well, meaning the number of errors per evaluation of break is the number of clones squared. Did I forget to mention that the break function has run without screen refresh checked, causing the editor to freeze, jolt and lag, as well as the grabbing and allocating memory. And maxing out the CPU.
Any code added anywhere with this running will find itself unable to create clones (300 clone limit surpassed) as well as heating up and crashing the computer running it. And grabbing memory until there is no more to grab, leaving variables misbehaving.
And, after there's too much lag to trigger the when [timer v] > (0) block, it'll still be running break.
Thanks to @towerofnix for reminding me about the when I receive glitch I found a while back, and giving me the idea for run without screen refresh. If you liked this, here's the original: https://codegolf.stackexchange.com/a/61357/43394

+1 Also might be fun to run an atomic (run without screen refresh) block with stop this script in it :P

How does that "when I receive glitch" work?

@Scimonster The when I receive hat block is only designed to take input from the drop-down list. The join[][] block returns a data type that the when I recieve block isn't designed to accept. Every time something is broadcast, all of the hat blocks check, and evaluate the return value of the block, throwing an incorrect type error.

I see. Though you have to hack the JSON file to actually get the join block in there.

@Scimonster It was really easy actually! I just used ScratchEdit

What happens if your code includes something like forever: stop other scripts in sprite, which should stop your cloning timer-resetting nonsense faster than it can start up again. Meanwhile, you can create a second sprite and do useful work in it.

@ppperry ... ...

@wizzwizz4 I don;t understand what you mean by ...

I downvoted this answer because it doesn't seem valid to me as per my previous comment on May 28 last year; Why can't this be broken by adding forever: stop other scripts in sprite;reset timer;delete this clone in one sprite and doing useful work in another.

@ppperry It depends on how the project is executing - the script execution order, to be specific. The reset timer would cause the when [timer v] > 0 block to run each time that is triggered, which would cause the broadcast. Depending on the execution order the delete this clone may run before or after the clone is created - if run after then the clone will still have a chance to receive the corrupt broadcast. The break code will still run without screen refresh, trashing the GUI, meaning that it would be really hard to add extra code in the first place, but assuming that you [cont. ]

manage to get the code in and assuming that the execution order is just right and taking for granted that you are using a version of Scratch that ignores errors then you could write the two programs necessary for a language to be considered a language as per this question so that they run quickly enough for the browser not to hang before they are complete, for small enough n in the case of the primality test.

I misunderstood what reset timer did, so just remove that from the loop. Still, since this setup requires external editors to create anyway, I don't see why one couldn't use external editors to add useful code, bypassing the problem in the last sentence of the first comment. Following the same rules that make languages without arbitrary precision integers valid, "for small enough n", doesn't apply, so assuming a version of scratch that ignores errors exists, this does not actually succeed in making the language unusable (although it does come close).

@ppperry It's dependent on a version of Flash that ignores errors - this does exist. Taken to its extreme, "for small enough n" could be used to say (n-1) works for positive n < 3, but as this is algorithm-based a good algorithm should be able to make n large enough to be able to shrug that argument off. I'm not sure whether a faster or slower machine would make it more usable. However, I agree that this solution can be worked around. It's not a [tag:cops-and-robbers], but well done anyway.

Of course, I'm assuming that that code is written under both the green flag and start as clone hat blocks, as otherwise it would not work.

I did this one time by mistake, I don't exactly remember how, but I had accidently messed scratch up that my computer crashed and never turned back on :(

@KrystosTheOverlord That sounds like hardware failure; Scratch doesn't have the ability to actually break your computer so it doesn't turn back on.

@wizzwizz4 That was probably it. I had run a scratch program, and closed my computer, when I opened it back up it was super hot and had several thousand clones and then halted, I shut it off, then it wouldn't turn back on... :(

PHP
I'm suprised that it actually works, but closing STDOUT and STDERR suppresses all output. To be sure that they will not be opened again, we open /dev/null three times to reassign the file descriptors 0, 1 and 2:
<?php
fclose(STDIN);
fclose(STDOUT);
fclose(STDERR);
fopen('/dev/null','r');
fopen('/dev/null','w');
fopen('/dev/null','w');

// insert program here

More on that: https://stackoverflow.com/questions/937627/how-to-redirect-stdout-to-a-file-in-php

There are other valid output forms, including writing to files and using the program's exit code. See the link in the relevant bullet point of the spec.

What exactly is allowed and not was not obvious to me. In the tag wiki for example I found nothing about files and exit codes. But if they are allowed, I don't think I can turn this into a valid submission.

Edited the question to allow disabling only one output form.

@jimmy23013 what? That completely defeats the point of the question.

@jimmy23013 If it's valid to just disable only one output form then for example suppressing the program's exit code (as Martin suggested) is all I need to do even though the language is completely useable without an exit code?

@JerryJeremiah Yes but I don't think you can get many upvotes.

Why doesn't this get more upvotes?

Mathematica / Wolfram Language
Mathematica is an interpreted language in which command names are symbols that can be manipulated by the programmer. You can't delete built-in operators, but you can overload them or otherwise modify their function. The following scrambles the "With" command, which is needed for assignment to variables even internally. This change prevents the kernel from holding arguments unevaluated until the assignment is complete, and it kills the language quite dead.
ClearAttributes["With", HoldAll]

If this command is run in an interactive session or within a block of code, Mathematica will not even be able add 1+1 (the resulting error message is about a page long so I won't include it here).

DOS batch (prior to Windows 95 I believe)
CTTY

Issued with no arguments, this disconnects the command line from the terminal. Any further attempts to read input or generate output don't do anything.
In case you wanted to know how to use CTTY correctly:
MODE COM1,8600,8,N,1
CTTY COM1

A slightly more powerful batch file could even answer the modem and connect whatever dialed in to CTTY.

Common Lisp
(set-macro-character #\( (lambda (x y) ()))

I hope you didn't need those opening parentheses.
This is a reader macro that tells the Lisp Reader to replace each instance of ( with a call to (lambda (x y) ()), a function that takes two arguments and returns nothing. So, for example, it would read (foo) as foo), interpret foo as a variable and then throw an unmatched parenthesis error on 0.

Please also interpret ) as something breaky! That way, there will be fewer errors.

I love this. "What does lisp rely on? One single character? It would be a shame if something... happened to it..." It's the same logic as redefining \\ in TeX.

Scratch
Here's a pretty simple example that will crash your browser (and, in theory, your computer):

I left this running for about twenty seconds, then lost 2.65 GB of memory to Scratch. Only a moment later and 5 GB were gone.
I highly suggest you have a means to force quit either Adobe Flash or your web browser before running this!

I really wanted to make a cool answer like the clear(this) JS one but sadly Scratch doesn't have any ways to do that. Feel free to update this post (or make your own) if you DO find another way to make Scratch unusable though!

Where do you add the user code, and is it actually executed?

User code? Anywhere in the project, as long as this snippet is inserted. It is executed once 0.3 seconds after the initial run, and then every 0.3 seconds (except that it also constantly reruns a script with no end, making Scratch very slow). Is it okay if I update this post with a better, more powerful crasher?

Somebody using Scratch... d:-D YAY!!!

@towerofnix By the way, I've improved / radically modified / recreated this here: http://codegolf.stackexchange.com/a/61490/43394 Mine doesn't rely on Microphone being on.

@wizzwizz4 Yes yours is much better than mine. please go vote his

As the specification of this question says, you should leave a place for inserting new code, and the objective is to make that inserted code behave abnormally or have limited functionality, not just to crash the interpreter.

Have you programmed with Scratch before? If not, Scratch runs multiple scripts at once. These scripts are not literally connected in any way. I suggest you try programming with Scratch so that you can understand.

@jimmy23013 To answer your question about Scratch, Scratch is an event-driven language. Those things at the top of the scripts, called hat blocks, are triggered on events, such as the loudness of the Microphone input being higher than 12, or the project being started. All the code attached to the hat block is run asynchronously from all the other scripts. There are also sprites, which contain images and sounds, and can display one image and play one sound at once. If you want to learn more, visit the Scratch website or the editor d:-D

Trivally stopped: put forever: reset timer;stop other scripts in sprite, which will kill all the invocations of the insta block, ant prevent the timer from ever reaching .3, so that the loop never restarts (and even if it did, it would just be stopped again). Meanwhile, you can do some work in another sprite.

I think you meant loudness to be timer, if I'm not mistaken.

Note that this code will not crash in Turbowarp with Warp Timer activated

Thue
::=

With a newline at the end
The thue language relies on defining rulesets and a ::= denotes the end of the ruleset. It is impossible to do ANYTHING in thue without defining rules that do it, so regardless of what you put after the ::=, nothing can happen.
Alternative answer
A::=
B::=
C::=
D::=
E::=
F::=
G::=
H::=

(and so on for the every character in all of Unicode including those before the A character and non-printable characters). This requires the command-line option -r.

I guess the text isn't grammatically the same thing as something satisfies the criteria (such as a ruleset).

Befunge-96
'~h

The user's code can follow anywhere after this sequence, as long as these are the first three characters in the source.
The ' command (one-shot string mode) pushes the ASCII value of the ~ onto the stack (i.e. 126), and the h command then sets what is known as the Holistic Delta with that value. For those not familiar with Befunge-96, the Holistic Delta is an offset that is added to the value of every command byte that the interpreter encounters.
Once the delta is set to 126, the only valid command that can be generated is ~ (character input), via a null byte in the source. Anything other than a null byte would translate to a value greater than 126, and none of those values would be valid Befunge commands.
I think it's safe to say that this would make it ineligible to qualify as a programming language.

MATLAB
The following piece of code makes the environment completely unusable1:
builtin = @(varargin)false; clear = @(varargin)false;
%// Insert code after this point

This overrides the builtin function and the clear function with new anonymous function handles that simply return false every time you try and call these functions.  The builtin function ensures that if there are any custom functions you write in MATLAB that are the same name as those that are built-in to MATLAB (things like sum, max, min, etc.), you are able to call these unambiguously instead of the overloaded functions.  Similarly, clear gives you the ability to clear all variables that are currently declared so you can start anew.  By removing these capabilities, there is no way that you can use MATLAB unless you restart the program.
In MATLAB R2015a, I also get the following message:

The Workspace are the variables that are currently declared in the environment so that you can use them for later.  This permanently disables the Workspace, so any variables you try and create will not be saved and hence no progress can be made when executing lines of code in MATLAB.
1: Credit goes to user Dev-iL who originally discovered the idea.

In R2014b you can do feval('clear') to fix it. Or: s=str2func('clear'); s().

///
/\///

The only operation in /// is repeated string substitution, like this: /pattern/replacement/.
This code removes every /, that way you can't use repeated string substitution, so basically everything you write after that will get printed (except for /s).
You can still use \s, but that won't help you much.

I've always wondered if it's possible to write a piece of /// code which is guaranteed to erase everything after itself, and thus halt without printing anything. It seems impossible, but I haven't thought of a proof that it's impossible.

Boo
macro harmless:
    Context.Parameters.Pipeline.Clear()

And then, somewhere else in the project,
harmless

A simple macro with a harmless-sounding name, but an amazingly frustrating effect.  The Boo compiler uses a multi-step pipeline that begins with parsing source into an AST and ends with code generation.  (Generally.  It can be reconfigured for various applications.)  Every step in between performs various operations on the AST.
Partway through is the macro expansion stage, in which macros are executed in the context of the compiler.  Remember the bit in the last paragraph, about the pipeline being reconfigurable?  If, during macro expansion, you invoke a macro that clears the pipeline, no error will be displayed to the user, but all steps after macro expansion (including code generation) are no longer there.  So you end up with something that looks like a successful compilation--no error messages displayed--but for some reason there's no binary produced!  Guaranteed to drive even the best troubleshooters up the wall, if you hide the macro and the invocation well.

This answer is invalid, as the user code never gets executed.

@ppperry: Sure it does: the macro can be written as part of the user code, and it's executed inside of the compiler.

You would have to define such a macro for a character of set of characters that needs to be typed in every single program or set of programs that makes boo fit the criteria.

@ppperry: yes, invoking the macro (anywhere in the code) is what causes the compiler to break, fulfilling the criteria.  If you're trying to say something deeper than that, you'll have to be a bit more clear, because I don't see what the problem is.

@MasonWheeler: As per the specification: the code inserted after the harmless macro must somehow be executed by the CPU/interpreter. If the macro breaks the compiler then it does not fit the criteria (note the infinite loop example in the challenge)

@slebetman: Boo also has a REPL.  I just checked, and if you run this macro on it, then every line you try afterwards will cause the compiler to throw an exception, which makes this trick functionally equivalent to the JavaScript example that's currently the highest-voted answer on here.

@MasonWheeler: Not exactly, throwing exceptions is a run-time process. Failing to compile happens before runtime.

@slebetman: And when you have a REPL, or macros where user code is executed at compile time, the distinction between the two gets very blurry.

I'm pretty sure this can be busted w/ another macro.

NGN/APL
NGN/APL allows redefining primitives, so redefining (←) all primitive functions to ⊢ ("pass through": both ⊢3 and 2⊢3 gives 3) makes the language completely useless:
⍪←-←+←?←⍵←∊←⍴←~←↑←↓←⍳←○←*←⌈←⌊←⍕←⊂←⊃←∩←∪←⊥←⊤←|←<←≤←=←≥←>←≠←∨←∧←×←÷←⍒←⍋←⌽←⍉←⊖←⍟←⍱←⍲←!←⌹←⊣←⍎←⊢

Try it here.

-1 for now, but this seems promising! Maybe if you redefined all the primitives…

@BlacklightShining There you go.

Ruby (29 characters)
class Object;def send;end;end

As 'send' is used internally whenever a method is called within Ruby, and since all objects inherit from the Object class. This should stop any method being run.
Fun Fact: This is perfectly sound in theory. But it appears, for some reason, not to hobble the Ruby language. I have no idea why it's possible to run this code and then still use an open Ruby environment.

Actually this works in the Pry Ruby shell.

Do you mean it works as in "this breaks it" or it works as in "it still works after this"? Only, I did mention the second being the case in plain old irb

I mean it breaks Pry. It doesn't break IRB, and it doesn't break running in .rb files, but it does break Pry.

Interesting. I'd guess there's some protection on the send method that isn't working in pry.

Taxi, 2354 bytes.
This little program simply runs the taxi in a large joyride through Townsburg, running out of gas. Any code you run after this will quickly error with error: out of gas. And even if you could reach a gas station, which I don't think is possible, you couldn't get any gas, as no money has been collected, since there are no passengers.
Go to Trunkers: west, 1st right, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st right, 1st left, 3rd left, 2nd left, 3rd left, 2nd right, 1st right, 2nd right, 1st right, 1st left, 1st left, 1st left, 1st right.

Tcl
foreach x [info commands] {if {$x!="rename"&&$x!="if"} {rename $x ""}}

This removes all keywords from the language except if and rename.
The above code would cause any new code to error out. So it's debatable if the new inserted code actually gets "executed". Below is a version that executes new code but does nothing because it changes all keywords (except if and proc) to a no-operation:
foreach x [info commands] {if {$x!="if"&&$x!="proc"} {
    proc $x args {}
}}

Instead of deleting keywords this code replaces them with a function that does nothing.
(Note: I'm using "keywords" very loosely here because Tcl doesn't have keywords, only functions)

I think you can make it better by renaming if and rename after the loop. In the second version, you should also make proc an exception.

@jimmy23013 Hmm.. technically you should be right but that code snippet works with the current version of tcl even when proc appears in the list before puts. Technically the code should also work without rename but built-in commands seem to be protected otherwise. Not sure what's going on but the code is tested and works as advertised.

@jimmy23013: OK. Code now works without needing to call rename. It was brainfart on my part - I forgot to exclude proc.

I decided not to rename if because being able to do if alone is pretty much useless if you want to generate output.

Of course you don't need to rename them. But this is not code-golf. I just thought renaming them may (or may not) make this answer looks better.

Before seeing you answer, I was trying to answer in Tcl and I followed the same reasoning line of your first approach!

Factor
UNUSE: syntax

Try it online!
It's not a joke, you can really unload the "built-in" syntax elements. And then you cannot write anything useful: you can't load any library, you can't define a named function or a lambda, you can't take input from stdin (or anything) or print to stdout (or anything). The engine still tries to parse the source code; it just fails because it forgot everything it needs to know.
There is still one thing that works: pushing number literals (which seems to be built into the engine itself). But you can't do any arithmetic or interesting stuff with them.

Zsh, 6 bytes
set -n

Try it online!
zsh has an option no_exec or -n which permanently disables all commands. I have absolutely no idea why.

JavaScript in browser
Well, at least in IE11.
window.addEventListener("error", function(){});
document = document.write = alert = prompt = confirm = console = void(
    (function (window) {
        try {
            //Code goes here
        } catch (e) {}
    })({})
);

Disables writing to the document, writing to the global variable and returning from the function.
Comment if I've missed out an output method!

Exceptions will still show in the console. You can handle those by doing window.addEventListener('error',function(){});

@IsmaelMiguel Now I can't take all the credit! d;-D

Does this seriously work? That makes no sense at all: document should still be accessible from the outer scope in the inserted code, and it shouldn't get replaced until after the inserted code has finished executing.

@PeterTaylor :-( Your logic broke my theory.

@PeterTaylor Please tell me how to fix (I mean break) document!

It's not easy

@PeterTaylor But you can lock out document.write! d:-D

Haven't tested IE, but confirm("something") works in my browser

document.body.innerHTML=""

@user2428118 Yup, I can't get rid of document! Even though it's the most used output method.

Ran this in console, then tried to upvote it...

Ruby 2.2.3
protected_methods = [:instance_methods,:__send__,:remove_method,:include?,:==,:to_s,:call,:pop]
protected_constants = [ObjectSpace, NameError, Exception, Module]
END{exit(0)}
ObjectSpace.each_object(Module) do |mod|
  next if protected_constants.include?(mod)
  im = mod.instance_methods
  while (meth = im.pop)
    next if protected_methods.include? meth
    mod.__send__(:remove_method,meth) rescue NameError
  end
  singleton = (class << mod;self;end)
  singleton_im = singleton.instance_methods
  while (meth = singleton_im.pop)
    next if protected_methods.include? meth
    singleton.__send__(:remove_method,meth) rescue NameError
  end
end
s = (class << self;self;end)
ms = s.instance_methods
while (m = ms.pop)
  next if protected_methods.include? m
  s.__send__(:remove_method,m)
end

# Your code goes here

Ah, I love ruby. This code iterates through every Module (including classes) and un-defines all the methods, except for the ones in protected_methods. Anything you try to call is undefined, including Object#method_missing which means, due to a ruby quirk, a stackoverflow (technically stack level too deep) error is thrown.
Fun fact: if Exception is not in protected_constants then ruby 2.2.3 segfaults (maybe I should submit a bug report about that /s).
This was surprisingly bigger than I was first expecting, particularly because many things can't be DRY, because that would involve using methods that I need to be undefined.
I am pretty sure this works. I've taken a multi-layered approach in that even if you manage to get something in, you probably won't be able to do anything to it; 5+4 results in undefined method '+' for 5:Fixnum, and good luck getting anything out.

In case anyone needs to debug this, or if I forget, you can output after undefining IO#write if you grab a reference to it beforehand:
debug = STDOUT.method(:write)
class IO;remove_method :write;end
debug.call('foo bar')

Hoon
=<  ~
(your code)

Hoon is a odd. It's pretty much entirely unlike other programming languages, not only in syntax but in semantics. Unlike languages like Hexagony, though, it wasn't made to be purposely esoteric.
Hoon compiles to Nock, a minimal combinator based VM. Nock is stupid: the spec can be gzipped to 340 bytes. The only math operation is incrementing. Everything is a noun: an atom (bignum) or a cell (pair of nouns), with the entire memory model arranged in an immutable acyclic binary tree. The only output is the noun that your expression reduces to.
Because of the weird compilation target, Hoon is also weird: it's completely pure. Hoon compiles down to a Nock expression that is evaluated on a "context". The entire kernel and stdlib, along with all variables, are passed implicitly to the program by the context.
To make Hoon unusable we just use =<, which is "evaluate a in the context of b". We are always evaluating ~, which is zero. No matter what b does, it can't change the value it reduces to, and since it can't have side effect it can't do input or output.
Side note: Since you can't actually prompt for input from Hoon (purity!), by the rules it isn't actually a programming language. Input is via function arguments, output via return values (or ~&, which is more of a printf debugging feature and is transparent to the program).
For a program to get input in Urbit, you actually write a program that return a function that accepts input, and the shell asks on your behalf and passes to the callback.

Definitely a programming language by our standards, though

GolfScript
"#{def eval(s) end}":+:%:/:,:*:do:while:until

The series of :foo replaces all of the looping operators and addition and concatenation, but that's not sufficient. It's also necessary to prevent deferring the computation to Ruby's string interpolation, which I accomplish by replacing Ruby's eval operator using a string interpolation. String literals which occur later in the source code will be passed through my no-op eval rather than the built-in one.
The reason it's necessary to replace all of the looping operators, even such innocuous ones as ,, is that primality testing doesn't require unbounded looping. E.g. the following uses only , in its three forms (range, filter, len) to do primality testing:
~.,2>{1$\%!},,\;

The reason for replacing + is that jimmy23013 proposed using quining to get a looping construct. The specific implementation he provided doesn't work because by clobbering foo I've also clobbered the (standard) interpreter's way of parsing strings, but I expect it could be reworked using blocks instead of strings so I'm playing it safe.

Primality test is still possible: ~.1>2\'3$3$\'@2$-@@2$0>!.+.+.+.+.+.+>.~\'.~;;!!@&@)\@3$3$>.+.+.+.+.+.+.+>.~'.~;\;\;. Without eval strings and numbers can't be specified directly, but there are workarounds like n[n!!.+.+.+.+.+.+]+.

Seems to give an error in the online tester; I'll try it at home later. Is the idea basically to use a quine technique to get a loop?

Yes. It doesn't work with "#{def eval(s) end}" directly and need some more complex workaround, which I'm not bothered to implement yet.

Why not just block ~? Those .+.+... can be replaced with 1000 0 if.

Or [.\;0 0 0 0 0 0 0 0]2base for example.

Blocking ~ wouldn't prevent evaluation of blocks, because that can be done with :X;X. But without + to compose strings / blocks, you can't make a quine, can you? I'm attacking the looping construct rather than numeric addition.

The loop is constructed by duplication of strings, not concatenation. I chose to use sequences of .+ to do 1000 0 if because + looks least likely useful for loops.

Why not just block everything...?

Forth
0 set-order

Basically, tell the interpreter/compiler that there are no dictionaries of known instructions.  It can still read numbers (because they're not instructions) and they'll go on the stack if interpreting, but you can not issue any instructions about what to do with them, nor can you restore the search order because that would require issuing an instruction.

INTERCAL-72
DO ABSTAIN FROM NEXTING+REINSTATING

INTERCAL has a command for globally disabling the ability of other types of commands to run. (Using it in this form is generally considered a bad idea, because it's a global action-at-a-distance which has no way to exactly reverse it; more recent versions of INTERCAL also have ABSTAIN #1 FROM which is exactly reversed by REINSTATE, but that wasn't around in the time of INTERCAL-72, the oldest version of the language.)
ABSTAINING from REINSTATING is an even worse idea, because it then becomes impossible to even approximately reverse the effect of the ABSTAIN; you can't do a global REINSTATE (the crudest way to get the commands working again) if you can't do any sort of REINSTATE. All we have to do, therefore, is to disable enough other commands at the same time that the language becomes impossible to program in. INTERCAL-72 only has one useful control structure (NEXT/RESUME/FORGET), and disabling NEXT by itself is enough to make it impossible to do any sort of loop.
In more modern versions of INTERCAL, there are a ton of other ways to do control flow (COME FROM, WHILE (not the same as C's while!), TRY AGAIN, GO AHEAD, etc.), and even other ways to reinstate lines of code (e.g. AGAIN), so an answer in modern INTERCAL, while it could use the same general idea, would be a lot longer.

Java
I decided to do something little bit nasty and break java, by using little bit less code than here
       public class a {

            static {
                final SecurityManager securityManager = new SecurityManager() {
                    @Override
                    public void checkPackageAccess(String pkg) {
                        throw new RuntimeException("broken");
                    }
                };
                java.lang.System.setSecurityManager(securityManager);

            }

            public static void main(String[] args) throws Exception {
             //and here goes your code...

            }
        }

You know, I can just do this. Not sure if that counts though.

I don't think that counts as a crack.

@BenjaminUrquhart fair point,   fixed

If you wish to subject your answer to "cracks" that consist of adding code to the end (which I don't think are valid), then your fix can still be worked around.

Found a "crack" that is contained within the main function. Takes 2 ints as arguments and outputs to stderr via an exception with a message set to the sum of those values. Will link once I can find a way to make it fit in a comment.

TIO

I'm pretty sure that counts as a crack assuming output via stderr is ok. I tried using an ArithmeticException instead because it makes more sense but the security manager catches that.

@BenjaminUrquhart Your "crack" doesn't invalidate this answer because of the "You can also choose one or some of the allowed output methods" rule.

@pppery fair enough

Z80 assembler
Two bytes are enough to completely hang any Z80 based system:
di
halt

aka "Disable interrupts, then halt until an interrupt arrives". Yeah, sure!
EDIT: I had missed the "code that crashes doesn't count" part in the question, so I guess that this does not qualify.

Duplicate: http://codegolf.stackexchange.com/a/61281/25180

ForceLang
def io nil
def gui nil
def require nil
def goto nil
def gotoex nil
def if nil
def undef nil
def def nil
<your code here>

Uses def to mask a bunch of key stuff, including all of the language's IO and most of the language's control flow. Then uses def to mask undef so you can't undo any of it. Finally, uses def to mask itself just because it can.

Go
I did it! I really finally did it! I've been stewing on this problem for months but I finally have a definitive solution that I challenge anyone to crack!
package main

import (
    . "runtime"
    . "os"
)

func main() {
    const (
        Chmod = iota
        Chtimes
        Create
        Exit
        File
        FindProcess
        Lchown
        Link
        Mkdir
        MkdirAll
        NewFile
        Open
        OpenFile
        Process
        Remove
        RemoveAll
        Rename
        Setenv
        StartProcess
        Symlink
        TempDir
        Truncate
        Unsetenv
    )
    Stdout.Close()
    Stdin.Close()
    Stderr.Close()
    defer func() {
        go func() {
            // User code here
        }()
    }()
    Goexit()
}

My definitive reddit post on this problem for Go.
But now, I have a solution. By forcing the user's code to execute in a goroutine, and then terminating the main goroutine with runtime.Goexit, the user can no longer set the exit code. If they panic the program crashes, yes, but if they don't then it also crashes, per the documentation of Goexit:

Calling Goexit from the main goroutine terminates that goroutine without func main returning. Since func main has not returned, the program continues execution of other goroutines. If all other goroutines exit, the program crashes.

I give up, omfg

@cat Nonverbal communication can be hard to understand at times. Are you impressed, or annoyed that I have continued to notify you about my progress on this challenge?

I'm genuinely sorry, I guess I should have appended a :D -- I'm impressed, and only cheerfully annoyed at your awesome answer c: I don't mind you keeping me updated.

Mascarpone
0^

Mascarpone is a language that is quite similar in concept to Emmental, but taken to the extreme. Interpreters are first class objects, so you can push interpreters to the stack, modify them, and then use them on program strings.
In this case, the initial interpreter assigns 0 the meaning of "push to the stack an interpreter in which every character is defined to cause an error." ^ is assigned the meaning of "pop an interpreter off the stack and assign it as the new interpreter for subsequent characters in the program." This means that any characters added after this will error.
Alternatively, if this violates the "code must actually execute" rule, there are many other ways to break the language.
v'_>1^

This is similar, but instead of defining every character to be an error, it defines every character to be a no-op. That way, every character of your code is technically executed, but it just has no effect.
Here's another way:
v'_v>'x<^

x should be replaced with a command here. This essentially creates a new version of the current interpreter with x redefined to be a no-op, and then assigns that as the new interpreter.
While disabling commands might seem devastating, Mascarpone actually seems fairly flexible to the removal of individual commands.

It only really needs [v*:! to simulate the Turing-complete ():^ subset of Underload.
' can be used instead of [, so disabling it doesn't kill the language.
Disabling . (the output instruction) doesn't work, as you can still output via exit code (erroring/not erroring).
Instead of ! (execute operation), you can have v'_<^_ (assign the operation to a command in a new interpreter, then switch to that interpreter and run that command).

I believe disabling v, *, or : might kill the language, but this is only 3 commands out of 18.

Javascript
Tested in Chrome.
Object.defineProperty(document,"body",{get:function(){return null}});
Object.defineProperty(document,"innerHTML",{set:function(){}});
Object.defineProperty(HTMLElement.prototype,"innerHTML",{set:function(){}});
Object.defineProperty(HTMLElement.prototype,"innerText",{set:function(){}});
HTMLElement.prototype.appendChild=document.createElement=document.getElementsByName=document.getElementsByClassName=document.getElementsByTagName=document.getElementsByTagNameNS=document.getElementById=document.write=document.writeln=console=document.querySelector=document.querySelectorAll=alert=setTimeout=prompt=confirm=open=Array=Array.prototype.constructor=Object=Object.prototype.constructor=Object.prototype.toString=null;
try{var window = {}; with(window){/*code*/} }catch(e){}

Browser javascript is really hard to break.

document.body.innerHTML=""

@user2428118: Fixed!

Is it intentional that this immeadetly redirects the browser's location to 'null'?

No, it isn't. Let me fix that.

setTimeout('throw "Test"',10) works for output too. Also window.open('data:text/html,a%20div').

@IsmaelMiguel I think I just fixed that.

window.open works. I didn't see your comment because you forgot to add  before the code. Also, you could use try{var window = {}; with(window){ /*code*/ } }catch(e){} to disallow window access.

@IsmaelMiguel Good idea

@SuperJedi224 One thing I forgot: var window = {}; for(var k in this)window[k] = 0; with(window){ /*code*/ }. And you don't need most of your code. Hopefully.

Operation Flashpoint scripting language
A feature I once discovered accidentally: You can create a variable with a name that's already taken by a command, thus making the command inaccessible. It can be recovered from by deleting the variable, but the command that is used to remove a variable can also be overwritten.
Save the following as init.sqs in the mission folder:
; Overwrite commands that can be used to execute code with variables with the same name.
call = 0
exec = 0
drop = 0
addEventHandler = 0
createDialog = 0

; There are other commands that could do the task, but not without input from the player.
; Any command in the game can be overwritten (except operators whose name doesn't begin
; with a letter, those are not valid variable names), so to be completely sure one could
; overwrite every single command, but these should suffice.

; Even if somehow ("onFlare.sqs", "onPlayerKilled.sqs" or some other scripts that are called
; automatically under specific circumstances) one gets a script running, make it impossible
; to create loops. Recursion is only possible with 'exec' or 'call' (and technically with 'drop').
goto = 0
while = 0
forEach = 0

; Overwrite the 'nil' command so that it cannot be used to recover from the above.
; Without this, "call = nil" would make 'call' work again (or any other overwritten command).
nil = 0

; Your code can be added here at the end of this script or anywhere else in the mission.

Now there is no way to use any kinds of loops or recursion.
Trying to call a piece of code outputting "Hello, World!":

Python 2
import sys
sys.setrecursionlimit(1)

Sets the maximum recursion depth to 1.
After entering these 2 lines, any subsequent line will yield:
RuntimeError: <exception str() failed>

Edit: They fixed this bug in Python 3.
Python 3
import sys,os,_thread

def poll(id):
    while True:
        sys.stdout = None
        sys.__stdout__ = None
        sys.stderr = None
        sys.__stderr__ = None
        open = None
        os.system = None
        builtins = None

_thread.start_new_thread(poll, (1,))

Print will now output nothing.  Any other command that creates output gives:
RuntimeError: lost sys.stdout

Edit: The sys.__stdout__ = None serves to prevent the user from recovering sys.stdout using sys.stdout = sys.__stdout__.  Credit to @someone.
Edit: sys.stdout could also be redirected to a file using sys.stdout = open("output.txt","w").  The open = None prevents this.  Credit to @someone.
Edit: Added os.system = None because it could also be used to print.  Credit to @Jonathan Frech
def print(x):
    os.system("echo {0}".format(x))

Edit: open can be recovered by:
import builtins
open = builtins.open

To prevent this, I made the whole script into a thread.
Edit: Added builtins = None to disable builtins.open.  Credit to @Jonathan Frech

Can sys.stdout = sys.__stdout__ recover python 3 version?

@someone Indeed.  Setting it to None as well seems to do the trick :)

Can we output to a file with sys.stdout = open("abc.txt","w")?

Outputting text is most likely still possible using os.system.

I think your last edit should say sys.stdout instead of sys.stdin.

One could try to recover open using import builtins; open = builtins.open. Having access to an open file, sys.stdout can be redirected which leads to a functional print function.

I think your thread only constantly removes sys.stdout's reference to any file, import builtins;builtins.open("out.txt","w").write("txt"), however, still works.

I believe the entire Python 3 answer can be broken using __subclasses__,  like many other python answers.

HP48 calculator family
OFF

Turns the calculator off.

StackStream
{ new-stream }     'stdinout def
{ drop exec }      'if def
{ drop drop exec } 'elseif def

Basically, this redefines the default symbol 'stdinout' to return an empty stream, which points nowhere. It then defines 'if' and 'elseif' to always run the first branch, so output is always the same.

Python
#Run the following in Python IDLE (spoiler: don't)
import os, shutil, sys
try:shutil.rmtree(os.path.split(sys.executable))
except:pass
os.system("python")

This functions by deleting most of the Python interpreter.  Then it recursively starts itself.  Any code you type afterward will fail horrendously.

Does this really work in IDLE? Because in the normal REPL on my system, os.path.split(sys.executable) -> ('/usr/bin', 'python3'). And /usr/bin is only writable by root…

@BlacklightShining maybe you're running in root to begin with. Anyway, my sacrifical system ran Windows, which is decidedly stupider about such things.

It meets the asker's criteria, then. I'm still not sure I like it personally, though, given that it only breaks the language if the system has insane permissions…

TeX (LaTeX)
\output{\setbox1\vbox{\unvbox255}}}
\let\output\relax

You can still do a lot in a code that starts with this. However, no pages will be ever produced. The output routine that takes care of building up the pages is destroyed, and also its "handle" is destroyed so that you cannot rebuild it. Needless to say, you can still compute a lot of stuff and output them in a file or in the log; you just can't use this crippled TeX to produce any document.
To disable writes, you can simply add:
\let\write\relax

You can't disable the log though.

Javascript
You can stop any output destroying (most of) the window object.
Also, you can't get rid of document, but you can crush it's content every millisecond.
Here's what I came up with:
(function(window){
    var html = document.getElementsByTagName('html')[0];

    setInterval(function(){html.innerHTML='';}, 1);
    window.addEventListener('error', function(){});

    for(var k in window)
    {
        if(k!='location')
        {
            window[k]=window;
        }
    }
})(Function('return this')());

This sets every single object inside window (except location, it will reload the page) to be ... the window object!!!
This will mess directly with the real window: Running Function('return this')() will return the this object for that context. Since that is eval'ed code, it will be the ... window object!
This also catches all exceptions by setting an handler on window, before deleting everything.
Also, we go grab the  element and set it's innerHTML to an empty string. This means that your output will work for less than a millisecond.
Your code is still executed. It just won't be able to show any output. Maybe you can create a file! If only the API wasn't destroyed...

Warning: This causes huge strain on your CPU and RAM. Run this at your own risk! It may cause overheating on your CPU and abnormal behaviour on your browser. It forces the code to run as many times as the browser can handle, in a second. This may cause a huge queue of functions to be executed, if it takes longer than the minimum time interval (which is 4ms for Firefox and Google Chrome (source provided by @somebody))
To stop the process, either run document.location=document.location or press F5.
I am NOT responsible for ANY hardware or software damage or data loss caused by running this code.

Most browsers don't support intervals less than about 10ms.

@SuperJedi224 What browsers? It works everywhere where I try it

I heard somewhere that there was a minimum of 10ms in chrome and 15ms in FF and safari. Apparently, this is no longer the case. However, there is still a minimum of 4ms with nested timeouts and 1s in tabs that are not currently focused.

@SuperJedi224 But there aren't nested timeout. They seem to work fine on any browser I throw this at. If this worked only on a single version of a very specific browser, it was acceptable. Watch the most voted answer: it only works on a specific engine, in a specific version.

What I meant is that the information on which I had based my first comment was apparently outdated.

@IsmaelMiguel Just because it works fine does not mean it is running every 1 ms. The fastest browsers (FF/Chrome) have a hard minimum of 4ms. source

@IsmaelMiguel new Worker(URL.createObjectURL(new Blob(['console.log("Hello world")']))) I broke out.

IBM Mainframe Assembler - 6
la 15,0

On entry to any program, Register 15 contains your base address. Overwrite that value, and expect an 0C4 abend (addressing exception) almost immediately.

Welcome to the site!

That appears to be 7 bytes.

Bash, 60 bytes
shopt -s extdebug;f(){ return 1;};declare -rf f;trap f DEBUG

Your code goes afterwards. I abused this answer which uses a debugging feature.  The return code of the function determines what to do with the original command.
I had to add the declare -rf f; bit to make the function read-only.  This addresses @Gilles workaround.
I think this complies with the rules since code is still being taken in by the interpreter as the next command without infinite loops, crashing, etc.
Let me know if there is another workaround.

TXR Lisp
(set *package* (make-package "X")*package-alist*())

The TXR Lisp dialect has a package system that is inspired by the one in ANSI Common Lisp. TXR Lisp not only has the variable *package*, but also exposes the list of packages themselves as the special variable *package-alist*, which can be assigned, or subject to a dynamic binding.
If we change *package* to a new, empty package, we can still reach functions in the usr package:
1> (set *package* (make-package "empty"))
#<package: empty>
2> (+ 2 2)
** warning: (expr-2:1) unbound function +
** (expr-2:1) + does not name a function or operator
3> (usr:+ 2 2)
4

However, if we also clear the *package-alist*, we will prevent the usr: prefix from being usable:
4> (usr:set usr:*package-alist* usr:nil)
nil
5> (usr:+ 2 2)
expr-5:1: usr:+: package usr not found
** syntax error

Of course, we should do this manipulation first, then clobber *package*, or do it all in one set form:
After this is evaluated, the rest of the code is in an inescapable, empty sandbox.

QBasic, 29 bytes
FOR i=0TO65535:POKE i,0:NEXT

Overwrites current segment (containing code and important data structures of the interpreter) with zeros.
Similar code may have similar effects on most interpreted BASIC implementations running on bare metal.

Pyth (in safe mode)
D
;Dp;

Just redefines both methods of printing with the wrong arity, any attempt to print will now crash the interpreter, including implicit prints.

Batch Prompt, 7 bytes
cmd>NUL

Regardless of the command entered, it will disappear into the NUL abyss.

Simplex v.0.5
h]$g$o$s$`$$u1{vbR4Rl<?[{;L}#]{p}u}
h]                                   ~~ define macro 0 as nothing
  $ $ $ $ $                          ~~ grab next character and redefine its function to
                                     ~~ evaluate the current macro number (0)
   g o s ` $                         ~~ redefine output as a string (g), output as number
                                     ~~ (o), as a character (s), or as a result of
                                     ~~ suppression (`) and also prevents the user from
                                     ~~ redefining them back, if possible
            u1                       ~~ goes up a strip and sets the byte to 1
              {                   }  ~~ repeat inside until a zero byte is met
               v                     ~~ goes down a strip
                b                    ~~ takes input as a string and puts to strip
                 R4Rl<               ~~ right, 4, right, length => length < 4
                      ?[     ]       ~~ perform inside iff byte is not zero
                        {  }         ~~ loop inside until zero byte is met
                         ;L          ~~ pushes the character to the outer program, left
                            #        ~~ stops evaluation (goes to outer program)
                              { }    ~~ loop inside until zero byte is met
                               p     ~~ removes current byte
                                 u   ~~ goes up a strip to meet the 1 byte; essentially
                                     ~~ a while(true){...} loop.

Essentially, destroys the output commands, then takes input from the user as strings, pushing them to the outer program, until a null-length string is encountered, at which point evaluation ceases and the user's input (the outer program) is evaluated. The user cannot output anything nor can they redefine anything. This thus eliminates the criteria of being able to output anything. If you want to eliminate input, simply put a $ in front of each of G, b, and i before the octothorpe (#) 6 characters before the end.

Perl
Not only will this make perl unusable, but your entire machine will seize up in seconds...  Also works well for bash.
while(fork){fork}

Because fork returns the PID of the child process, or zero for the parent, evaluation the first-fork will create two processes.  One of those will exit the loop, and continue evaluation.  The other will enter the while body, and create one additional new process with the second-fork.  These two processes will again hit the first-fork and create and additional two processes, for a total of four.  Two of those will exit the while loop, and execute following code a second and third time.  The other two will again enter the loop body.  Then four processes will be tested in the first-fork, creating 8 processes, four of which execute the following code for a 4th, 5th, 6th and 7th time.  And so on.
On any unix system, you run out of PID numbers and the fork begins to fail when you have 32k processes,  but at this point, the scheduler is so busy that any interaction with a windowing system or shell is unusably slow.

Is the code after that actually executed?

@jimmy23013 good question.  The answer is yes; I updated my response to reflect this.

In all fairness, Perl is unusable out of the box.

What if your code includes kill(getppid())?

Common Lisp
(setq *debugger-hook* (lambda (a b) (abort)))

(set-macro-character #\( (lambda (stream char)
                           (read-delimited-list #\) stream)
                           (values)))

Step one is to disable the debugger. I do this by binding the *debugger-hook* (which is called immediately before entering the debugger) to a function which cancels whatever tried to enter the debugger in the first place. Then, I turned ( into a comment character- everything up to its matching close paren is completely ignored.
The result, tested on sbcl at the repl (both line-by-line and #'load ing it from a file), is a repl which completely ignores any meaningful code. Literal values (number, strings, symbols, etc.) work just fine, but anything else is just ignored.

What old-paren?

PowerShell
(gv ex* -v|% S*).LanguageMode=2

This doesn't work on TIO (which uses PowerShell core) but it does work on Windows PowerShell. Additional code can (attempt to) be executed directly after this (via ; or newline).
Putting PowerShell into NoLanguage mode makes it effectively useless unless you pre-defined allowable commands to execute.

No need to count bytes.

@user75200 true, fixed

Funky
for v in values({math, string, table, io, _G})
    for k in keys(v)
        v[k] = nil

This nukes the math functions, then the string, table, and IO functions, and finally, cleans out the _G table.
The math functions are actually what's called when operators are used, so without them, most functionality is gone.
But you can do math with table functions, if you get smart, so they're nuked too.
When the _G table is cleared, all forms of IO are finally also gone, and the getMetaFunc function is also nuked, which causes errors if most things happen.
After this, the language is entirely unusable.
Try it online!

Rust
macro_rules! toilet{
  ($($_:tt)*)=>{}
}

fn main(){
  toilet!{
    Your code goes here.
  }
}

Try it online!
I defined a toilet macro that causes the compiler to delete any code inside of it. Anything, including the main function, can be deleted in this manner.
use std::alloc::{GlobalAlloc,Layout};
struct EvilAlloc{}
unsafe impl GlobalAlloc for EvilAlloc{
  unsafe fn alloc(&self,_:Layout)->*mut u8{
    std::ptr::null_mut()
  }
  unsafe fn dealloc(&self,_:*mut u8,_:Layout){}
}
#[global_allocator]
static EVIL: EvilAlloc = EvilAlloc{};
//your code here

Try it online!
This one creates and sets a malicious global allocator that will always fail or leak memory.

[min]mod
[].UNWRAP.SET[].IF.SET[].SET.SET

Try it step by step!
Set all the built-in instructions to empty stacks (noops), making all instructions based on those instructions noops as well, since they only execute noops in different orders :)

Enema
:OQ::!Q:

Code can come any place after this.
This language is similar to Emmental in that it is capable of redefining itself. Essentially, what we're doing here is redefining O (which normally is for output) to do nothing (thus making the language no longer have a transformational model) and then redefine ! (which can be used to reset a word to its default behavior) to do nothing as well.

O
N:+:-:/:*:@:\:[:]:1:2:3:4:5:6:7:8:9:0:{:}:<:>:=:#:%:^:?:d:w:o:p::;

This reassigns mostly everything to a null codeblock, making any code that contains these characters do nothing.
You could add every ASCII character to make sure they can't do anything, but this kills all arithmetic, stack manipulation, codeblock creation, array creation, pushing numbers to the stack, comparing numbers, control flow, outputting, and assigning variables.

Mouse-2002
$ ~your code here

In Mouse, $ denotes the end of the program, thus, anything after it will be evaluated and "run" but won't actually do anything. No online interpreter available, unfortunately, but here is a fixed-so-it-compiles-in-gcc version of the interpreter written in C.

Too bad it ain't ):

Invalid because the code after it wasn't actually executed.

@ppperry did you read past the first clause of the first sentence?

J, online interpreter
f =: f
f 3

This calls f with f with f with... etc. Here's what the page looks like:

Successive attempts at entering things in yields, well, nothing:

Tested on Firefox.

Hmm this only seem to break for me on the online interpreter using Firefox. The interpreter seems to be usable afterwards in Chrome, and jconsole handles the error completely differently locally. Might be worth noting.

@Sp3000 Huh, interesting. Consider it noted.

Lua
local write = io.write
local type = type
local pairs = pairs
local setmetatable = setmetatable
local function destroy(g,t)
    t = t or {}
    setmetatable(g, {__index = function() return write end,__newindex = function() return false end})
    for k,v in pairs(g) do
        if(type(v)=="table")then
            local has = false
            for k2, v2 in pairs(t) do
                if v2 == v then
                    has = true
                    break
                end
            end
            if not has then
                t[#t+1]=v
                destroy(v,t)
            end
        elseif(type(v)=="function")then
            g[k] = write
        end
    end
end
destroy(_G)
type = write
pairs = write
setmetatable = nil

A fun one, makes all functions, including string and table constructors, into the io.write function. It doesn't necessarily prevent the language from doing things it was already doing, but it does cripple it from this point onwards.
I chose io.write because I thought it interesting to see if I could make trying to run literally anything print. It didn't work so well.

Bash
exec &> /dev/null

Any code that comes after can execute whatever it wants, but its output is cast into the void of /dev/null.

File I/O still works though.

@eush77 True! However, the challenge stated that we could cover only a subset of the allowed output methods.

Right, I missed that.

Too bad exec &> /dev/tty easily reverses that :)

@eush77 True... If you really wanted to break it, you would do exec &> /dev/null < /dev/zero. But I'm pretty sure that breaks the rules.

If you can break out, it's invalid.

What if I rm -rf /dev/ right after?

S.I.L.O.S, 1 byte
0

Try it online!
Yes, in SILOS, your code can be made completely useless by editing the first line. With this, you can not store any variavbles (or take any input). Essentially it allocates 0 bytes of memory for the first line.

Forth (gforth), 8 bytes
0 >ORDER

Everything you type in after that except an empty line will result in Invalid memory address.
I stumbled upon this by accident just now, I don't know precisely how it works but I guess >ORDER adds a new dictionary to search in for words or something. And it can't read from address 0, the address we told it to search for first, so it throws an error.
Forth (RCOS), 10 bytes
0 LATEST !

Tells the Forth that no words have been defined (latest word is the null pointer). Thus, you can only input numbers, everything else results in an Unknown token error.
Forth (RCOS), 18 bytes
219 ' INTERPRET C!

Writes byte 0xDB (65C02's STP instruction which halts the processor) to the start of the INTERPRET word. Now, everytime that word is called, the processor is halted. What INTERPRET normally does, it takes an area of memory (most likely the line buffer) and executes the words in there in order. It gets called when you press enter to execute the current line. So, with our new behavior, everytime you press enter (aka call INTERPRET) it halts the computer.
Looks like there's many ways to break my RCOS, but what do you expect, it's written in assembly

JS, 11B
delete this

works with IE>8 and Edge (non-strict mode), with only workaround is exiting then reentering console to redefine them.

Staq
{ '}{{}}

which redefines the noop to push entered number to stack. Then { to }.

Crystal, 44 bytes
fun main(a : Int32,b : UInt8**) : Int32 0end

Try it online!
Works by overwriting the main function, so that rather than actually running code, it simply returns. Code can be inserted at any point after that, and it will simply be ignored.

JavaScript (Node.js), 23 bytes
for(y in this)this[y]=0

Try it online!
This script works almost universally unlike other JS examples here. I think I could probably shorten this using regex matching.

Doesn't really work with V8 in browsers unfortunately

Spice
A couple of ways:
1. ALS
;@
ALS LOD OUT;
ALS ADD SWI;
ALS SUB BRK;
ALS MUL NUL;

New code goes at the end.
Explanation
The first character of a spice program defines the delimiter, in this case ; which is usually followed by all variable definitions before @ denotes the beginning of operations on those variables.
ALS allows aliasing operations to other names, so here we overwrite some builtin operations with other. Because OUT, SWI, BRK and NUL are the only operations that don't require a variable as at least one argument, by aliasing them to pre-existing operations we make it impossible to invoke them, as aliases are resolved first.
2. Poorly defined delimiter
 @

(Note leading space)
Explanation
We define the delimiter as a space, making invoking any operation cause a runtime exception in the interpreter: this is the equivalent of writing code similar to:
;var1;@
ADD;1;2;var

which is nonsensical in Spice.

JavaScript (browser)
It's hard to test this since it breaks everything. Not sure if this is complete but it's easy to keep adding clear(somebuiltin) to remove more properties
const clear = (obj) => {
  for (const prop in obj) obj[prop] = undefined
}
window.addEventListener("error", () => {})
clear(window);
clear(document);
clear(console);

// code here
console.log(Number(prompt("a")) + Number(prompt("b")))

Only clear(window) should be enough, document and console are both properties of window

Yeah that seems like it would be like that intuitively @mousetail. I remember finding some workaround while I was testing but I'm going to double check

Befunge 98
 v
v>"PAMI"4("zqzCzOz=z.z,z)zozszM"akMn
>

Redefines the , and . instructions to NOPS to prevent out the standard way, then redifines the = instruction to prevent execution oif an arbirtrary program, then redefines the o instruction to prevent file output and the q instruction to prevent output by exit code, then redefines the C,O,M,and ) instructions to prevent you from undoing its definitions. Insert your code after the > on the third line.

Factor
Factor is a concatenative stack-based language, where all operators are words which are defined with :. Here, we kill the builtin print functions by defining them as nothing, and then redfine the macro redefiniton operator.
: stream-write ( -- ) ;
: write ( -- ) ;
: print ( -- ) ;
: . ( -- ) ;
: : ( -- ) ;

! your code here

DUP
[]⇒.[]⇒;[]⇒"[]⇒,[]⇒`[]⇒'[]⇒⇒ { your code here }

Redefine the print operators, the string allocation operators, and the input operators all to noop, and then define the definition operator ⇒ as  a noop.

Staq, 20 bytes
{` }{' }{: }{; }{{}}

Redefines all I/0 instructions as NOPs
Standard Staq instructions:

: output the topmost stack value to the console as a number
; output the topmost stack value to the console as a character
' push entered number on stack
` push value of entered character on stack
{ begin function definition
} end function definition

{` }                   define ` as NOP
    {' }               define ' as NOP
        {: }           define : as NOP
            {; }       define ; as NOP
                {{}}   define { as }

This way, no more functions can be defined, which would be necessary to reset the instructions to their original state.
In Staq, all predefined instructions can be reset to their original state by putting them between curly braces without a space. For example, : could be reset by writing {:}.
But that’s not possible anymore because the opening { is defined as }, which would result in a useless set of instructions: }:}, which in turn (due to the redefinition of :) means } }.
So, anything that gets executed after this block runs as normal, but is useless because there is neither input nor output possible anymore, and no way to define functions to restore that ability.

No need to count the bytes, this is popularity contest, not code-golf.

Python 3 REPL
def f():
    import gc
    obs = gc.get_objects()
    for ob in obs:
       if isinstance(ob, dict) and ob is not locals() and ob is not __builtins__.__dict__ and ob is not globals():
           ob.clear()
f()
#What can you do now!

@mbomb007 It works, but only in a REPL. https://tio.run/nexus/python3#XY9LDsMwCET3PQXLRGpzgEo9C7IdO6JywbLJ9esSR@oibNDAPD59jQnSND9vYEGfIlVhC0OJb/AysWxRUfw7Bm3TPFpJqrWB@DCd7IEnoEbc1HGIk/g7rBR0BsfrcDdgUcgSXLZBlzKi3ymr4YgL4kEiXjxbFj/Y/8rzziXk6KrdZp/0Tlx2NVEqseWvFCXh1h/0Aw

Japt
$Japt=undefined$

Test it online!

Can you replace it with $Japt=0 for savings?

Won't the embedded JavaScript still be run?

@Oliver Yes, but there's no closing $, meaning that I can continue to add Javascript after the assignment.

[][1] instead of undefined? :P

ForceLang
undef def
undef gui
undef io
undef if
undef goto
undef gotoex
undef require
undef undef

Your code goes after.

I'm pretty sure this doesn't actually do anything, since all undef does is remove a definition created using the def command and doesn't actually change the value of any variables (or in this case constants.)

JS (updated, compatible with IE11)
console.error=eval=0

Defines console.error to be eval which is redefined to be 0, which is no function but a number.
Output isn't directly possible.

alert is a valid output method for PPCG challenges by default.

But IE evals thus you can't alert your string. If you delete eval then try deleting console.error, you get The tab contains a modified eval function. It's possible the command program diagnostic windows won't work correctly, which is done by console.error.

Staq, elaborated more
{: }{; }{' }{" }{` }{{}}
{: }                    redefine : to NOP
    {; }                redefine ; to NOP
        {' }            redefine ' to NOP
            {" }        redefine " to NOP
                {` }    redefine ` to NOP
                    {{}}redefine { to }

If we didn't use {{}}, {:} can be used for restoring predefined characters.

C (gcc), 136 bytes
#include <stdlib.h>
#include <signal.h>
__attribute__((constructor))
void enable_io()
{
    // Make it clear that we are ready for IO
    raise(SIGPOLL);
}

Try it online!
Place it after any C file using libc (or LD_PRELOAD it for dynamically linked programs )
#include <stdio.h>
int main()
{
    puts("hello");
}

(note that the program did not output this, it is the shell):
$ ./a.out
I/O possible

The __attribute__((constructor)) is a feature that allows GCC to inject functions before main() runs, and we exit the program before main() by raising a signal saying that I/O is possible, making I/O impossible.
exit(0) works as well, but this is funnier.

Java
Building upon https://codegolf.stackexchange.com/a/61124/40787's input I saw that there is just too much boilerplate and reflection.
You can insert the code after the comment.
Edit
Saw this wasn't a strict code-golf, so prettied it a bit
import static java.lang.Thread.*;

import java.io.*;
import java.lang.reflect.Proxy;

import sun.misc.*;

public class Jail {

    public static void main(String[] a) {
        //user code here :D
        //Remember, do not do anything funky!
    }

    static {
        // From the original Java submission
        System.setOut(new PrintStream(new ByteArrayOutputStream()));
        System.setErr(new PrintStream(new ByteArrayOutputStream()));
        System.setIn(new ByteArrayInputStream(new byte[0]));

        // Block all access
        SharedSecrets.setJavaIOAccess(b(JavaIOAccess.class));
        SharedSecrets.setJavaLangAccess(b(JavaLangAccess.class));
        SharedSecrets.setJavaSecurityAccess(b(JavaSecurityAccess.class));

        //prevent throw new Error(output to show)
        setDefaultUncaughtExceptionHandler(b(UncaughtExceptionHandler.class));

        // Seal the deal
        System.setSecurityManager(new SecurityManager());
    }

    static <T> T b(Class<T> t) {
        return (T) Proxy.newProxyInstance(null, new Class[]{t}, (p, m, a) -> null);
    }
}

Original
import static java.lang.Thread.*;
import java.io.*;
import java.lang.reflect.*;
import sun.misc.*;

class X {

    static SharedSecrets s;

    public static void main(String[] a) throws IOException {
        // From the original Java submission
        a=null;
        System.setOut(new PrintStream(new ByteArrayOutputStream()));
        System.setErr(new PrintStream(new ByteArrayOutputStream()));
        System.setIn(new ByteArrayInputStream(new byte[0]));

        // Block all access
        s.setJavaIOAccess(b(JavaIOAccess.class));
        s.setJavaLangAccess(b(JavaLangAccess.class));
        s.setJavaSecurityAccess(b(JavaSecurityAccess.class));

        //prevent throw new Error(output to show)
        setDefaultUncaughtExceptionHandler(b(UncaughtExceptionHandler.class));

        // Seal the deal
        System.setSecurityManager(new SecurityManager());

        //user code here :D
        //Remember, do not do anything funky!

    }

    static <T> T b(Class t) {
        return (T) Proxy.newProxyInstance(null, new Class[]{t}, (p, m, a) -> {
            throw null;
        });
    }
}

If you write normal language syntax, it still works (mostly).
Also, opening files or trying to reset the streams is frowned upon.
Just wanted to get some lower number Java submissions.

Groovy
java.lang.Class.metaClass = Integer.metaClass
Integer.metaClass.plus = { Integer n ->     return 'a' }
Integer.metaClass.minus = { Integer n ->     return 's' }
Integer.metaClass.multiply = { Integer n ->     return 'd' }
Integer.metaClass.div = { Integer n ->     return 'f' }

I tried (without success) to overwrite the print commands, so I redefined the Object instead :)

Javascript
for(let q in this)delete this[q];

which deletes each property of this.
Or,
eval=0;

assigning 0 to eval, thus any input raises this:

The tab contains a modified eval function. It's possible, the command program diagnostic windows don't work correctly.

thus being irreversible by even restarting developer tools!

only works in IE>10.

eval=0 doesn't seem to work.

Python 3.11
import sys
sys.stdout.close()
sys.stderr.close()
def hook(a,b):
   raise RuntimeError()
sys.addaudithook(hook)
for key in list(sys.modules):
    del sys.modules[key]
del sys
del hook

Should prevent any kind of IO. Even suppresses any error messages. No modules can be imported. No files can be opened. Also disables use of eval and exec.
However, just by itself this code runs with no errors and exits with status 0.