{"version":"2.1.268","anchor":"artifact-read-permission-check-for-webfetch-now-runs-a-deny","canonical_anchor":"artifact-read-permission-check-for-webfetch-now-runs-a-deny","heading":"Artifact read permission check for WebFetch now runs a deny check both before and after network egress probing","tier":"notice","area":"Artifacts","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268\/e\/artifact-read-permission-check-for-webfetch-now-runs-a-deny","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268","markdown":"### Artifact read permission check for WebFetch now runs a deny check both before and after network egress probing\n\nWebFetch's permission check for reading claude.ai artifacts now re-checks deny rules after probing network access\n\n**What**\n\nWhen WebFetch is used to read a claude.ai artifact, Claude Code now runs its deny-rule permission check a second time, after the step that probes network access and shows any consent surface, in addition to the check that already ran earlier. Only after this second check passes does the flow move on to handling ask rules.\n\n**Why**\n\nRunning the deny check again after the network probe closes a gap where a deny rule might otherwise be missed if conditions changed between the first check and the actual network access.\n\n- Area: Artifacts\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5"}