[BUG] "All domains" egress setting not applied to Cowork cloud sessions
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
<html><head></head><body><h1>Bug report: Cowork cloud sessions ignore the "All domains" network egress setting</h1>
<p><strong>Organization:</strong> Albert.io (Team plan)
<strong>Reported by:</strong> Molly Cohen, molly@albert.io
<strong>Date observed:</strong> 11 September 2026
<strong>Product:</strong> Cowork, cloud sessions (Opus 5)
<strong>Example session:</strong> https://claude.ai/code/session_017qG1YUavsFysjzw5KRVe1k</p>
<hr>
<h2>Summary</h2>
<p>Our organization's domain allowlist is set to <strong>All domains</strong>. Cowork cloud
sessions are not receiving that policy. Instead, every session is issued a
fixed six-host allowlist, and the egress proxy returns 403 to CONNECT for
everything else, including our own company domain.</p>
<p>This began partway through 11 September 2026. No one in our organization
changed any setting before, during, or after the change in behaviour. The
same skills and scripts worked earlier the same day.</p>
<hr>
<h2>Expected vs actual</h2>
<p><strong>Expected:</strong> with the allowlist set to "All domains", a Cowork cloud session
can reach any host on the internet.</p>
<p><strong>Actual:</strong> sessions can reach exactly six hosts. Everything else is refused
at the proxy.</p>
<p>The six hosts the sessions are given:</p>
<pre><code>*.albert-dev.net albert-dev.net
*.cachix.org cachix.org
*.fontawesome.com fontawesome.com
*.github.com github.com
*.hex.pm hex.pm
*.oban.pro repo.oban.pro
</code></pre>
<p>We did not enter this list in any settings screen that we can find (see
"Configuration verified" below). It corresponds to an older engineering
configuration and is not what our current settings say.</p>
<hr>
<h2>Evidence</h2>
<h3>1. Per-host connectivity test, run inside a Cowork cloud session</h3>
<pre><code>www.albert-dev.net 200
hex.pm 200
cachix.org 302
repo.oban.pro 404
fontawesome.com 200
example.com blocked (connect_rejected)
www.albert.io blocked (connect_rejected)
</code></pre>
<p><code>example.com</code> is the control. Under an "All domains" policy it must succeed.
It does not.</p>
<h3>2. Proxy status output</h3>
<pre><code class="language-json">{
"ts": "2026-09-11T14:46:21.208Z",
"kind": "connect_rejected",
"detail": "gateway answered 403 to CONNECT (policy denial or upstream failure)",
"host": "www.albert.io:443"
}
</code></pre>
<h3>3. Application-level error</h3>
<pre><code>ERROR: 0 network_error: Tunnel connection failed: 403 Forbidden
(https://www.albert.io/blog/wp-json/ez-annotations/v1/public/books)
</code></pre>
<h3>4. Timeline</h3>
Time (UTC) | Event
-- | --
Earlier on 11 Sep | albert.io reachable; skills running normally
13:48:44 | First observed failure, a different user's session
14:46:21 | Failures reproduced in a second user's session
<p>No setting was changed by anyone at Albert.io before this started.</p>
<hr>
<h2>Business impact</h2>
<p>Eight production skills call albert.io APIs and are all non-functional:</p>
<ul>
<li>albert-quote-builder</li>
<li>contact-scraper-hq</li>
<li>content-ops-hq</li>
<li>ez-lit-master</li>
<li>flash-card-builder</li>
<li>pacing-guide-builder</li>
<li>renewal-slackbot</li>
<li>revenue-outreach-hq</li>
</ul>
<p>These cover sales quoting, contact sourcing, content operations, and
publishing workflows. There is no workaround available to us, since the
proxy cannot be bypassed by design and the settings screens offer nowhere
to add the domain.</p>
<hr>
<h2>Possibly related open issues</h2>
<ul>
<li>anthropics/claude-code#38984 — Cowork "Additional allowed domains" allowlist non-functional</li>
<li>anthropics/claude-code#19087 — Additional allowed domains not applied to container network egress</li>
<li>anthropics/claude-code#23818 — Cowork VM network egress allowlist ignores Admin Capabilities settings</li>
<li>anthropics/claude-code#51400 — Allowlist entries not enforced outside "All domains" mode</li>
</ul>
<p>Our case differs in one important way: those reports describe custom entries
being ignored while a package-manager baseline still works. In our case the
six hosts being honoured are not a package-manager baseline, and the mode
that is documented as the working fallback ("All domains") is the one being
ignored.</p>
<hr>
<h2>What we are asking for</h2>
<ol>
<li>Confirmation of why Cowork cloud sessions are receiving a host list that
does not match our organization's configured policy.</li>
<li>Restoration of the configured "All domains" behaviour.</li>
<li>If a per-session or per-organization override exists that is producing
this list, tell us where it is surfaced so we can manage it ourselves.</li>
</ol></body></html>
What Should Happen?
With our organization's domain allowlist set to "All domains", a Cowork cloud
session should be able to reach any host on the internet, including
www.albert.io. The egress proxy should allow the CONNECT.
Error Messages/Logs
Steps to Reproduce
- Set Organization settings > Capabilities > Code execution > Domain
allowlist to "All domains".
- Start a new Cowork cloud session.
- curl https://example.com -> blocked, connect_rejected
- curl https://www.albert.io -> blocked, connect_rejected
- curl https://github.com -> succeeds
Claude Model
Opus
Is this a regression?
Yes, this worked in a previous version
Last Working Version
2.1.268 (Claude Code)
Claude Code Version
2.1.268 (Claude Code)
Platform
Anthropic API
Operating System
macOS
Terminal/Shell
Terminal.app (macOS)
Additional Information
_No response_