You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
ArtifactsArea: what it touches
Bug FixesKind: in v2.1.268,
Bug FixesSection of the release
What
When WebFetch is used to read a claude.ai artifact, Claude Code now runs its deny-rule permission check a second time, after the step that probes network access and shows any consent surface, in addition to the check that already ran earlier. Only after this second check passes does the flow move on to handling ask rules.
Why
Running the deny check again after the network probe closes a gap where a deny rule might otherwise be missed if conditions changed between the first check and the actual network access.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeChanged plain WebFetch deny and ask rules to no longer apply to Artifact tool reads and updates; use an Artifact rule (or…
