[BUG] Cowork sandbox egress proxy blocks all custom domains regardless of org allowlist config — breaks access to own infrastructure

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Cowork sessions should be able to reach custom domains configured in Organization Settings → Capabilities → Code execution → allowed domains, exactly as documented. Outbound HTTPS to a domain explicitly added to that allowlist should succeed, not return connect_rejected from the egress proxy.

What Should Happen?

Claude Cowork sessions should be able to reach custom domains configured in Organization Settings → Capabilities → Code execution → allowed domains, exactly as documented. Outbound HTTPS to a domain explicitly added to that allowlist should succeed, not return connect_rejected from the egress proxy.

Error Messages/Logs

connect_rejected (the egress proxy denied the CONNECT (organization policy) or could not reach the destination)

curl -v output (CONNECT tunnel failed):
* Connected to 127.0.0.1 (127.0.0.1) port 40051
* CONNECT tunnel: HTTP/1.1 negotiated
* Establish HTTP proxy tunnel to <custom-domain>:443
> CONNECT <custom-domain>:443 HTTP/1.1
< HTTP/1.1 403 Forbidden
* CONNECT tunnel failed, response 403
curl: (56) CONNECT tunnel failed, response 403

Steps to Reproduce

1. In Organization Settings → Capabilities → Code execution, enable network egress and add a custom domain to the allowed domains list (e.g. yourdomain.com).
2. Start a new Cowork session (settings only apply to new sessions).
3. Run: curl -v https://yourdomain.com
4. Expected: HTTP response from yourdomain.com.
5. Actual: request never leaves the sandbox — fails at the local proxy (127.0.0.1) with "CONNECT tunnel failed, response 403" before any DNS/TCP attempt to the target domain.
6. Also tested: raw TCP connect to the domain on port 22 — times out completely (no RST), confirming the block happens at the sandbox's egress layer, not the destination.
7. In the same session, https://github.com works normally — confirms only github.com is allowlisted regardless of the custom domain configuration.
8. This reproduces consistently across multiple sessions, multiple custom domains, after restarting the local machine and changing local network — ruling out client-side causes.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

N/A — using Claude Cowork (cloud), not the Claude Code CLI

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

_No response_