[BUG] Managed hooks restriction bypassed when using ANTHROPIC_BASE_URL
## Bug: allowManagedHooksOnly restriction bypassed when ANTHROPIC_BASE_URL points to a local proxy
### Summary
When allowManagedHooksOnly: true is set via managed settings, Claude Code should prevent
execution of non-managed hooks and /statusline scripts. However, this restriction is not
enforced when the ANTHROPIC_BASE_URL environment variable is set to a local proxy address
(e.g., http://localhost:4010). In that configuration, both non-managed hooks and /statusline
scripts execute successfully, effectively bypassing the policy.
### Expected behavior
allowManagedHooksOnly: true should block all non-managed hooks and /statusline scripts
regardless of how the API backend is configured, including when routing through a local proxy.
### Actual behavior
Setting ANTHROPIC_BASE_URL=http://localhost:4010 (or any local proxy) causes the
allowManagedHooksOnly enforcement to be skipped. Non-managed hooks and /statusline scripts
run without restriction.
### Steps to reproduce
- Set
allowManagedHooksOnly: truein managed settings. - Start a local proxy (e.g., a Node.js HTTP server) on port 4010.
- Set
ANTHROPIC_BASE_URL=http://localhost:4010. - Launch Claude Code and attempt to run a non-managed hook or
/statuslinescript. - Observe that the hook/script executes despite the policy.
### Environment
| Field | Value |
|-------------|----------------------------------------|
| Platform | win32 |
| Terminal | windows-terminal |
| Version | 2.1.114 |
| Feedback ID | e68fdd02-35eb-489f-82e5-e937cea055fe |
5 Comments
If
allowManagedHooksOnlycan be bypassed simply by routing through a local proxy withANTHROPIC_BASE_URL, then the policy is being enforced in the wrong layer or under the wrong assumptions.The key point is that managed hook restrictions are supposed to be control-plane guarantees. They should not depend on whether the backend endpoint is direct or proxied, because proxying is a deployment detail, not a permission model.
From an operator perspective this is dangerous because the setting appears authoritative while actually being conditional. That creates false confidence:
That is worse than a clearly missing feature because it invites reliance on a control that is not actually invariant. Managed policy needs to survive transport/backend indirection if it is going to be trusted as policy at all.
Seems related to https://github.com/anthropics/claude-code/issues/49932
This issue involves a security policy bypass. I've escalated it through
Anthropic's official security reporting channel as recommended in
SECURITY.md.
Outcome:
Server-managed settings are a client-side policy distribution mechanism, not a security boundary against the local user. When
ANTHROPIC_BASE_URLpoints to a non-Anthropic endpoint, Claude Code is by definition not talking to Anthropic's API and cannot fetch organization policy from it; this limitation is documented at https://code.claude.com/docs/en/server-managed-settings#platform-availability and in the security-considerations table on the same page, which explicitly lists a non-defaultANTHROPIC_BASE_URLas bypassing server-managed settings. A user who can set an environment variable before launching Claude Code already has local shell access at their own privilege level and can run any command directly without going through hooks at all. Organizations that require enforcement ofallowManagedHooksOnlyshould deploy it via endpoint-managed settings (MDM-distributedmanaged-settings.json/ HKLM registry / macOS managed plist), which apply regardless ofANTHROPIC_BASE_URL.This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.