What
Expanded network security with a new deniedDomains field that blocks specific domains even if they match allowedDomains rules.
Details
- Accepts an array of domain strings with wildcard support (same syntax as
allowedDomains) - Merged from all settings sources regardless of
allowManagedDomainsOnly— meaning organization policies can always enforce domain blocking - Takes priority over
allowedDomains: a domain matched by both lists is blocked - Logs denials with the specific domain and port for debugging
Evidence
Schema definition (search for "Domains that are always blocked, even if matched by allowedDomains")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agree
Added sandbox.network.deniedDomains setting to block specific domains even when a broader allowedDomains wildcard would otherwise permit…