Claude Code bug: sandbox network ignores allowedDomains in 3p gateway deployments
ykhvainitski · ghdev · 2026-09-16
anthropics/claude-code issue #94758 reports that in Claude Desktop enterprise 3p deployments (macOS, embedded Claude Code 2.1.236/2.1.270) using a custom OpenAI-compatible gateway via ANTHROPICBASEURL, sandboxed Bash egress is pinned to just two hosts: the configured gateway and api.anthropic.com.
Key facts:
- api.openai.com, pypi.org, github.com and an internal CI host are all silently blocked by the srt egress proxy (curl exit 56) with no permission prompt; another machine showed explicit deny network-outbound 403 errors.
- Adding sandbox.network.allowedDomains to /.claude/settings. has no effect even after a full app restart.
- No network keys exist in claudedesktopconfig., and the /sandbox UI reports everything OK while the proxy keeps denying.
- Reproduced by 3 users on 3 machines; labeled bug, has repro, area:networking/sandbox.
A direct pitfall for anyone doing enterprise gateway integration or relying on sandbox networking for package installs and repo access.
More from coding & agent
- Microsoft's MemSteer turns unlabeled user histories into agent memory supervision — MicrosoftResearch · 2026-11-02
- She fired herself from her own Instagram: AI agent runs the account, views up 82.3% — heyshrutimishra · 2026-11-02
- Sourcegraph: AI writes code faster than teams can review it, driving more outages — AI Engineer · 2026-11-02
- Tsinghua & Microsoft's HarnessMM cuts agent token use by up to 87.93% while raising success rate — rohanpaul_ai · 2026-11-02
- GitHub launches Agent HQ: Anthropic, OpenAI, Google coding agents in Copilot — emmanuelvivier · 2026-11-02
- DeepSeek open-sources Super-Agent, a coding agent that reads team chats to minimize human input — emmanuelvivier · 2026-11-02