Back to rankings

Claude Code Patches a Web Sandbox Proxy Bypass

Claude CodeView original changelog

Anthropic fixed a network sandbox gap in Claude Code on the web, where requests from Bash and other tools to non-API anthropic.com hosts such as www and docs bypassed the session's network proxy. Because environment allowed-domain restrictions are enforced at that proxy, traffic to those hosts previously escaped the allowlist check meant to govern every outbound connection from a cloud session. Version 2.1.239, released August 21, 2026, routes these requests through the proxy like any other outbound call, so the environment's configured allowed domains now apply consistently. The fix is the latest in a recurring pattern of narrow gaps found in Claude Code's network sandbox enforcement.

Key Takeaways

  • A sandbox enforcement gap let Bash and other tool calls in Claude Code on the web reach non-API anthropic.com hosts (www, docs) without passing through the session's network proxy.
  • Allowed-domain restrictions only work if every outbound request passes through the proxy that checks them, and this fix closes one path that skipped that check.
  • The fix ships in version 2.1.239, released August 21, 2026, and applies specifically to Claude Code on the web (cloud sessions), not the local CLI.
  • The affected hosts were limited to Anthropic's own non-API domains, so this was a narrow gap rather than an open door to arbitrary external hosts.
  • This is not Claude Code's first network-sandbox allowlist gap: independent researchers have previously reported bypasses such as a SOCKS5 hostname null-byte injection and a misconfigured "block all" rule, both fixed in earlier releases.
  • No user action is required: the fix applies automatically to cloud sessions running the updated version, with no configuration change needed to benefit from it.

What Changed

Claude Code 2.1.239 closes a gap in how Claude Code on the web, Anthropic's cloud-hosted version of the tool, enforces its network sandbox. Previously, when Bash or another tool inside a cloud session made a request to a non-API anthropic.com host, such as the main www site or the docs subdomain, that request did not pass through the session's network proxy. Every other outbound request from a cloud session is checked against the environment's configured allowed-domains list at that proxy layer, but requests to these specific Anthropic-owned hosts slipped past the check entirely.

Why It Matters

Claude Code on the web runs agent sessions inside sandboxed cloud environments specifically so that a user or organization can restrict what the agent is allowed to reach over the network. That restriction is only as strong as its weakest enforcement path. A request that avoids the proxy avoids the allowlist, regardless of how benign the specific destination happens to be. In this case the affected hosts were limited to Anthropic's own non-API properties, so the practical exposure was narrow, but the underlying issue, an enforcement boundary with more than one path in or out, is the same shape of problem that has surfaced in Claude Code's sandbox before. With the fix, Bash and other tools now route anthropic.com requests through the same proxy as everything else, so an environment's allowed-domains configuration applies uniformly no matter which host a tool call targets.

Part of a Pattern

This is not the first time outside researchers or Anthropic itself have had to close a gap in Claude Code's network allowlist enforcement. Earlier issues have included a SOCKS5 hostname null-byte injection that let sandboxed code reach hosts outside the configured allowlist across roughly 130 releases before being fixed, and a separate misconfiguration where a "block all outbound traffic" setting was interpreted as "allow everything." Each of these was narrow on its own, but together they point to network sandboxing as an area Anthropic keeps needing to revisit as new code paths are added to Claude Code on the web. No user action is required for this fix; it takes effect automatically for cloud sessions running the updated version.