WebFetch checks an artifact's share entry and forces an ask, or a denial for another org, before its content enters the conversation.
WebFetch's permission check now dynamically loads a helper to decide whether an artifact fetch needs extra scrutiny before its content is allowed into the conversation. When enabled, it warms or reads the artifact's "share entry" to determine ownership: if the artifact belongs to another user, or ownership can't be confirmed, the request is forced to an ask decision with localDisplayOnly: true; if it belongs to another org, the request is denied outright.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
| `CLAUDE_CODE_WEBFETCH_DEADLINE_MS` | Upper bound in milliseconds on how long [WebFetch](/docs/en/tools-reference#webfetch-tool-behavior) waits for a page to download, including any redirects it follows. A download that hasn't completed b…env-vars see the edit
- `BetaManagedAgentsWebFetchToolConfig object`api/beta/sessions/archive see the edit
Anthropic's documentation has since written up WebFetch, on Archive Session.