What changed: Claude Code now detects and requires manual approval for any read or glob request touching the Linux automount -hosts map (paths under /net/…). Previously only Windows UNC paths were blocked this way.
Details
- Accessing
/net/<hostname>/...silently triggers a DNS lookup and NFS mount to a remote host, which is a potential data-exfiltration and latency vector. - The new check fires before any other access control decision.
- Message shown:
Claude requested permissions to read from <path>, which is under the /net automount map and could trigger a DNS lookup and NFS mount to a remote host. - Decision reason recorded:
"Automount -hosts path detected (defense-in-depth check)". - Both file reads and glob patterns are covered.
/proc/net/tcpand/proc/net/tcp6are also in scope (they reveal active network connections on Linux).
Evidence
Automount path detector (search for "Automount -hosts path detected (defense-in-depth check)")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.