Cowork VM egress allowlist ignores Admin Capabilities network access settings

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Admin Capabilities network access allowlist is not respected by the Cowork sandbox's egress proxy. I set Organization settings → Capabilities → Network Access to "Specific allowed domains" and added api.scryfall.com (also tested www.google.com, www.youtube.com), but requests to these domains from an active Cowork session still fail with a 403 at the proxy CONNECT stage. Only the hardcoded default domains (api.anthropic.com, pypi.org, registry.npmjs.org, api.github.com, etc.) are actually allowed through, regardless of what's configured in the admin UI.

What Should Happen?

Requests to any domain I've explicitly added to the Capabilities → Network Access allowlist should succeed, since that's what the admin setting is for.

Error Messages/Logs

curl -sS https://api.scryfall.com/cards/random
curl: (56) CONNECT tunnel failed, response 403

Proxy status endpoint (/__agentproxy/status) recentRelayFailures:
{
  "kind": "connect_rejected",
  "detail": "gateway answered 403 to CONNECT (policy denial or upstream failure)",
  "host": "api.scryfall.com:443"
}

The noProxy list returned by the same status endpoint only ever shows the hardcoded defaults, never the domains I added via the admin settings.

Steps to Reproduce

1. In org admin settings, go to Capabilities → Network Access, select "Specific allowed domains", add api.scryfall.com, save.
2. Start (or continue) a Cowork session.
3. Run a request to the allowlisted domain, e.g.:

curl https://api.scryfall.com/cards/random
(also reproduces via the WebFetch tool on the same URL)

1. Expected: request succeeds.
2. Actual: request fails with 403 at the CONNECT stage. The proxy status endpoint confirms the domain is not present in the effective allowlist.

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

1.52386.0 (1003ca)

Platform

Other

Operating System

Windows

Terminal/Shell

Other

Additional Information

This is happening in Cowork mode (Claude desktop app), not the Claude Code CLI — the "Terminal/Shell" and "Platform" fields don't have an exact match for this context, selected closest option.

This matches existing reports: anthropics/claude-code#23818, anthropics/claude-code#51400