Egress allowlist ignores "All domains": every host outside a built-in list gets 403 on CONNECT (regression 2026-09-10 -> 2026-09-11)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

With Allow network egress = ON and Domain allowlist = "All domains" (Settings -> Capabilities -> Code execution), the session egress proxy still rejects every host outside a small built-in allowlist with 403 on CONNECT.

This is a regression. It broke between 2026-09-10 and 2026-09-11. 18 scheduled Cowork tasks that had been running daily for weeks all stopped producing output on 2026-09-11. The schedule still fires and every run is recorded as SUCCEEDED, but the first outbound call in each run is denied.

Measured from the cloud container: blocked are json2news.radiobutler.com (my own self-hosted API), news.google.com, www.tagesschau.de, example.com; api.github.com is allowed. The proxy status endpoint reports "selective": false and "toolScoped": false, i.e. plain allowlist mode.

The local Cowork VM on the desktop (device_bash) is subject to the same policy, so there is no fallback: HTTPS returns 403 there as well, and sslin.df.eu (IMAP, port 993) does not even resolve. A task that reads a mailbox over IMAP from the local VM therefore cannot work under any allowlist configuration, since the allowlist only covers HTTP(S) via CONNECT.

The target hosts are healthy: reached from the very same machine through the regular browser, the blocked self-hosted API answers /health with 200.

This looks like the same root cause as #34690, #30112 and #51400 — the session proxy JWT carries a fixed allowed_hosts list and does not reflect the "All domains" setting. What is new here is that it is now a hard regression for a setup that worked until 2026-09-10.

Secondary issue: a run in which every outbound call is denied is still recorded as ROUTINE_RUN_STATUS_SUCCEEDED, and nothing is surfaced in the task list. Scheduled tasks fail completely silently; the only way to notice is that the expected results never appear.

What Should Happen?

With Domain allowlist = "All domains", outbound HTTPS from the cloud container and from the local Cowork VM should reach any host.

Additionally, a run in which every outbound call was denied by egress policy should not be recorded as SUCCEEDED — it should be marked failed, or the policy denial should be surfaced on the scheduled task.

Error Messages/Logs

# cloud container (bash)
$ curl -sS -o /dev/null -w '%{http_code}\n' https://json2news.radiobutler.com/
curl: (56) CONNECT tunnel failed, response 403
$ curl -sS -o /dev/null -w '%{http_code}\n' https://news.google.com/
curl: (56) CONNECT tunnel failed, response 403
$ curl -sS -o /dev/null -w '%{http_code}\n' https://example.com/
curl: (56) CONNECT tunnel failed, response 403
$ curl -sS -o /dev/null -w '%{http_code}\n' https://api.github.com/
200

# $HTTPS_PROXY/__agentproxy/status
"selective": false,
"toolScoped": false,
"recentRelayFailures": [
  {"ts":"2026-09-11T07:25:14.412Z","kind":"connect_rejected",
   "detail":"gateway answered 403 to CONNECT (policy denial or upstream failure)",
   "host":"json2news.radiobutler.com:443"},
  {"ts":"2026-09-11T07:25:20.208Z","kind":"connect_rejected",
   "detail":"gateway answered 403 to CONNECT (policy denial or upstream failure)",
   "host":"www.tagesschau.de:443"}
]

# local Cowork VM on the desktop (device_bash)
$ curl -sS https://json2news.radiobutler.com/
curl: (56) Received HTTP code 403 from proxy after CONNECT
$ python3 -c "import socket; socket.create_connection(('sslin.df.eu',993),15)"
[Errno -3] Temporary failure in name resolution

# same host reached from the regular browser on the same machine
GET https://json2news.radiobutler.com/health -> 200
{"status":"ok","utc":"2026-09-11T07:31:50Z","access":"open"}

Steps to Reproduce

1. claude.ai -> Settings -> Capabilities -> Code execution -> Allow network egress: ON
2. Domain allowlist: "All domains" (the UI then states "Claude can access all domains on the internet")
3. Start a Cowork cloud session (or let a scheduled task fire)
4. In the session, run: curl -sS -o /dev/null -w '%{http_code}\n' https://example.com/

Result: curl: (56) CONNECT tunnel failed, response 403. Expected: 200.

Same result inside the local Cowork VM via device_bash, and for any non-allowlisted host.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Claude Desktop 1.52386.0 (worked until 2026-09-10)

Claude Code Version

Claude Desktop 1.52386.0 (Cowork cloud session)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

Environment: Claude Desktop on Windows, app version 1.52386.0 (Electron 44.2.0, Node 24.20.0), Cowork cloud session, model claude-opus-5. Personal organization, single user, I am the owner; the setting is verified in the UI and reads "Claude can access all domains on the internet".

Impact: 18 scheduled tasks (daily news research and upload pipelines for two radio stations, plus an IMAP mailbox monitor) produce nothing since 2026-09-11 while all being reported as successful. Blocked hosts include a self-hosted API (json2news.radiobutler.com), news sources (news.google.com, www.tagesschau.de, www.helgoland.de, sessionnet.owl-it.de and several Ukrainian outlets) and an IMAP server (sslin.df.eu:993).

Related: #34690 (All domains not reflected in session proxy JWT), #30112 (custom domains blocked with 403 blocked-by-allowlist), #51400 (additional-domain entries not enforced).