### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

Bug report: Cowork cloud sessions ignore the "All domains" network egress setting

Organization: Albert.io (Team plan)
Reported by: Molly Cohen, molly@albert.io
Date observed: 11 September 2026
Product: Cowork, cloud sessions (Opus 5)
Example session: https://claude.ai/code/session_017qG1YUavsFysjzw5KRVe1k

---

Summary

Our organization's domain allowlist is set to All domains. Cowork cloud
sessions are not receiving that policy. Instead, every session is issued a
fixed six-host allowlist, and the egress proxy returns 403 to CONNECT for
everything else, including our own company domain.

This began partway through 11 September 2026. No one in our organization
changed any setting before, during, or after the change in behaviour. The
same skills and scripts worked earlier the same day.

---

Expected vs actual

Expected: with the allowlist set to "All domains", a Cowork cloud session
can reach any host on the internet.

Actual: sessions can reach exactly six hosts. Everything else is refused
at the proxy.

The six hosts the sessions are given:

*.albert-dev.net      albert-dev.net

*.cachix.org          cachix.org

*.fontawesome.com     fontawesome.com

*.github.com          github.com

*.hex.pm              hex.pm

*.oban.pro            repo.oban.pro

We did not enter this list in any settings screen that we can find (see
"Configuration verified" below). It corresponds to an older engineering
configuration and is not what our current settings say.

---

Evidence

1. Per-host connectivity test, run inside a Cowork cloud session

www.albert-dev.net       200

hex.pm                   200

cachix.org               302

repo.oban.pro            404

fontawesome.com          200

example.com              blocked (connect_rejected)

www.albert.io            blocked (connect_rejected)

example.com is the control. Under an "All domains" policy it must succeed.
It does not.

2. Proxy status output

{

  "ts": "2026-09-11T14:46:21.208Z",

  "kind": "connect_rejected",

  "detail": "gateway answered 403 to CONNECT (policy denial or upstream failure)",

  "host": "www.albert.io:443"

}

3. Application-level error

ERROR: 0 network_error: Tunnel connection failed: 403 Forbidden

(https://www.albert.io/blog/wp-json/ez-annotations/v1/public/books)

4. Timeline

Time (UTC) | Event
-- | --
Earlier on 11 Sep | albert.io reachable; skills running normally
13:48:44 | First observed failure, a different user's session
14:46:21 | Failures reproduced in a second user's session

No setting was changed by anyone at Albert.io before this started.

---

Business impact

Eight production skills call albert.io APIs and are all non-functional:

• albert-quote-builder


• contact-scraper-hq


• content-ops-hq


• ez-lit-master


• flash-card-builder


• pacing-guide-builder


• renewal-slackbot


• revenue-outreach-hq

These cover sales quoting, contact sourcing, content operations, and
publishing workflows. There is no workaround available to us, since the
proxy cannot be bypassed by design and the settings screens offer nowhere
to add the domain.

---

Possibly related open issues

• anthropics/claude-code#38984 — Cowork "Additional allowed domains" allowlist non-functional


• anthropics/claude-code#19087 — Additional allowed domains not applied to container network egress


• anthropics/claude-code#23818 — Cowork VM network egress allowlist ignores Admin Capabilities settings


• anthropics/claude-code#51400 — Allowlist entries not enforced outside "All domains" mode

Our case differs in one important way: those reports describe custom entries
being ignored while a package-manager baseline still works. In our case the
six hosts being honoured are not a package-manager baseline, and the mode
that is documented as the working fallback ("All domains") is the one being
ignored.

---

What we are asking for

1. Confirmation of why Cowork cloud sessions are receiving a host list that
   does not match our organization's configured policy.


2. Restoration of the configured "All domains" behaviour.


3. If a per-session or per-organization override exists that is producing
   this list, tell us where it is surfaced so we can manage it ourselves.

### What Should Happen?

With our organization's domain allowlist set to "All domains", a Cowork cloud
session should be able to reach any host on the internet, including
www.albert.io. The egress proxy should allow the CONNECT.

### Error Messages/Logs

```shell

```

### Steps to Reproduce

1. Set Organization settings > Capabilities > Code execution > Domain
allowlist to "All domains".
2. Start a new Cowork cloud session.
3. curl https://example.com -> blocked, connect_rejected
4. curl https://www.albert.io -> blocked, connect_rejected
5. curl https://github.com -> succeeds

### Claude Model

Opus

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

2.1.268 (Claude Code)

### Claude Code Version

2.1.268 (Claude Code)

### Platform

Anthropic API

### Operating System

macOS

### Terminal/Shell

Terminal.app (macOS)

### Additional Information

_No response_

No implementation files, tests, or entry points are identified in the report. Start by locating the Cowork cloud-session egress policy and organization domain-allowlist handling, then reproduce the listed curl checks with “All domains” enabled. Done means the configured policy is applied and hosts such as example.com and www.albert.io are no longer rejected.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.