Claude Code bug: sandbox network ignores allowedDomains in 3p gateway deployments
ykhvainitski · ghdev · 2026-09-16
anthropics/claude-code issue #94758 reports that in Claude Desktop enterprise 3p deployments (macOS, embedded Claude Code 2.1.236/2.1.270) using a custom OpenAI-compatible gateway via ANTHROPICBASEURL, sandboxed Bash egress is pinned to just two hosts: the configured gateway and api.anthropic.com.
Key facts:
- api.openai.com, pypi.org, github.com and an internal CI host are all silently blocked by the srt egress proxy (curl exit 56) with no permission prompt; another machine showed explicit deny network-outbound 403 errors.
- Adding sandbox.network.allowedDomains to /.claude/settings. has no effect even after a full app restart.
- No network keys exist in claudedesktopconfig., and the /sandbox UI reports everything OK while the proxy keeps denying.
- Reproduced by 3 users on 3 machines; labeled bug, has repro, area:networking/sandbox.
A direct pitfall for anyone doing enterprise gateway integration or relying on sandbox networking for package installs and repo access.
More from coding & agent
- Diorama gives OpenAI Codex coding agents a visual office you can watch work in real time — davidfromkansas · 2026-09-17
- Code-first, UI on top: building bespoke brand design tools with AI — floguo · 2026-09-17
- Study of 7 models across Claude Code, Codex, Pi: harness barely affects success but swings cost — DavideCrapis · 2026-09-17
- AI trading bot built with Jev is down 85%, owner shrugs it off — generativist · 2026-09-17
- Redditor's 3-Day SoL-Pi Test: Memory Objects Save ~12k Tokens Per Tool Run — Garblyx · 2026-09-17
- Reviewing AI code through Steve Jobs' lens: unseen internals deserve beauty too — sergeykarayev · 2026-09-17