Follow Discord
Sweep 06 Nov 2026 · 01:32Z Build v2.1.319 537 read Stable v2.1.311 Latest v2.1.319 Next v2.1.319 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeDocsClaude Documentation 24 Oct 2026
One change · claude-docs

Security and data handling changedclaude-tag/concepts/security-and-data

Nearest release: v2.1.310, published 22 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Upstream edited this page at 24 Oct 2026 20:09 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 24 Oct 2026 20:37 UTC.

Upstream edited
Recorded here
Lines+2added
Lines−2removed
From line 47 where the diff opens
First seen 14 Aug 2026 this site's first read of the page
Recorded edits31to this page, all time

The whole hunk

from line 47, old and new numbered
/
lines
from line 47
4747 
4848### Network egress
4949 
50In an Anthropic-hosted environment, outbound traffic from a channel session's sandbox is default-deny, apart from its GitHub API requests and git operations. Requests go only to hosts an allow layer covers, and the layers are a [credential's allowed websites](https://claude.com/docs/claude-tag/admins/connections/custom.md#fill-out-the-custom-tool-form), the [allowed domains](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that apply to the channel, and the network access setting of the [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) for what happens to a request under each layer.
50In an Anthropic-hosted environment, outbound traffic from a channel session's sandbox is default-deny, apart from its GitHub API requests and git operations. Requests go only to hosts an allow layer covers, and the layers are a [credential's allowed websites](https://claude.com/docs/claude-tag/admins/connections/custom.md#fill-out-the-custom-tool-form), the [allowed domains](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that apply to the channel, and the network access setting of the [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment) the scope's sessions run on. A new environment's default level, **Limited access**, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) for what happens to a request under each layer.
5151 
5252![Flow diagram across two zones, labeled Anthropic's infrastructure and your systems. In the first zone, a session sandbox that holds no stored credentials sends every outbound request to Agent Proxy, which matches it against admin rules. Three outcomes branch toward your systems: on a rule match, the credential is attached at the boundary and the request proceeds; on an allowlist-only match, from an allowed domain or the environment's network access setting, the request is sent without credentials; on no match, the request is blocked entirely (the default-deny outcome) and the host is unreachable.](https://mintcdn.com/claude-ai/f29MqpCRlPctgTn5/images/claude-tag/diagrams/proxy-decision.svg?fit=max\&auto=format\&n=f29MqpCRlPctgTn5\&q=85\&s=f87bc9ca2d2de09e4feda0a60695e9bd)
5353 
54Because requests to any other host are blocked, data leaves the sandbox only to hosts an allow layer covers and to GitHub through the GitHub proxy. An admin sets the allowed websites on each credential and the allowed domains. An admin sets the environment's network access level, which defaults to Trusted access, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) and [Allow a host without a credential](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential).
54Because requests to any other host are blocked, data leaves the sandbox only to hosts an allow layer covers and to GitHub through the GitHub proxy. An admin sets the allowed websites on each credential and the allowed domains. An admin sets the environment's network access level, which defaults to **Limited access**, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) and [Allow a host without a credential](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential).
5555 
5656Allow-all egress is a `*` domain. The entry admits requests to any host on the ports it lists, still without credentials. Private and internal network addresses and cloud metadata endpoints remain blocked. See [Allow all hosts](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-all-hosts).
5757 
Feedback