Cowork Desktop: local "Additional allowed domains" / "All domains" egress stopped being enforced after 2026-09-11 update (VM 2.1.260 worked, 2.1.266 blocks)

Summary

On the Cowork desktop app (Individual Pro), a custom remote MCP connector's file upload worked on 2026-09-10 and regressed on 2026-09-11 after a background auto-update, with no change to my settings. The sandbox's outbound file PUT to an allow-listed custom domain is now rejected at the egress proxy (403, host never reached), even with Domain allowlist = "All domains". Tool calls over the MCP proxy path are unaffected; only the sandbox's direct egress is blocked.

Environment

• Claude desktop app 1.52386.0 (installed via ShipIt at 2026-09-11 02:36:50)
• Cowork runtime (claude-code-vm): 2.1.260 -> 2.1.266 (new folder created 2026-09-11 02:37; prior version purged by the updater)
• macOS, Individual Pro plan

What worked (2026-09-10, VM 2.1.260)

Desktop Cowork, custom remote MCP connector whose upload flow PUTs file bytes to a custom domain (an ngrok tunnel). Settings -> Capabilities -> Allow network egress ON, Domain allowlist = "Package managers only" with my host added under "Additional allowed domains". A tool call did request_upload_url then a curl PUT of file bytes to the returned custom-domain URL. The PUT succeeded - bytes reached the server (confirmed server-side: a 14,641-byte upload received), and the downstream job completed.

What breaks now (2026-09-11, VM 2.1.266)

Identical settings and connector. request_upload_url still succeeds (reaches the MCP server via the proxy). The subsequent curl PUT is rejected with 403 at the sandbox egress before any byte leaves the sandbox - the destination host is never contacted. Switching Domain allowlist to "All domains" does not help; the additional-domains entry appears ignored.

Reproduction

1. Desktop Cowork, Pro plan; enable a custom remote MCP connector whose upload flow PUTs file bytes to a custom domain.
2. Settings -> Capabilities -> Allow network egress ON; add the host under "Additional allowed domains" (also tried Domain allowlist = "All domains").
3. In a Cowork task, run a tool that calls request_upload_url then curl -X PUT --data-binary @<file> <returned-url>.
4. Observe: the MCP tool call reaches the server; the file PUT is 403-blocked at egress; no bytes arrive.

Expected: with the host allow-listed (or "All domains"), the sandbox's outbound PUT reaches it.
Actual: 403 (host_not_allowed / blocked-by-allowlist); user-level additional-domains not enforced.

Isolation done

• Not the server: the MCP server is reachable, tools/list returns, request_upload_url returns the correct allow-listed host, /doc serves 200. The failing PUT produces no server-side log line at all - it never arrives.
• Not the connector / proxy path: all MCP tool calls (via the MCP proxy) work throughout; only the sandbox's direct outbound egress is blocked.
• Not web: web Cowork never worked for this (there is no user-facing domain-allowlist control in web settings), so this capability only ever existed on the desktop VM path - which is exactly what regressed.
• Timing: the regression correlates precisely with the 02:36 app / 02:37 VM update; the immediately prior VM (2.1.260) worked with identical settings.

Ask

Restore enforcement of user-level "Additional allowed domains" (and "All domains") for the sandbox's direct outbound egress in the Cowork desktop VM 2.1.266.

Likely related

#51400, #34690, #38984, #30112, #63182