Unclear Whether this rewritten guidance is actually shown to any given user depends on the same unread tengu_flickering_rain setting.
The sandbox instructions built into the system prompt (under a 'command sandbox' heading) were substantially rewritten for when the new network-list capability is active. The model is now told to list every host a command needs, that the sandbox is applied per command at the operating-system level, and to check a <sandbox_violations> block for any denied hosts. If a host was denied, the instructions say to re-run the command with that host added to allowed_domains when in auto mode. Separately, the wording used when sandboxing is fully disabled by policy was softened from a blanket prohibition to language that tells the model to ask the user instead.
This gives the model concrete steps to follow when a sandboxed command is blocked from reaching a network host, instead of leaving it to guess how to retry.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Configuring a mirror removes the public package hosts from the sandbox's network allowlist and admits the mirror host in their place, so a misconfigured mirror fails with an error that names the mirror rather than falling back to the publi…claude-science/corporate-networks see the edit
* Added per-command `allowed_domains` to Bash, PowerShell and Monitor in auto mode with sandboxing: the hosts a command needs are reviewed with it and opened for it alone; other hosts are refusedchangelog see the edit
* For Bash tool: includes `bash_command`, `full_command`, `timeout`, `description`, and `dangerouslyDisableSandbox`, plus `git_commit_id` and `git_branch` when a `git commit` command succeeds. `git_commit_id` is the full commit SHA when th…monitoring-usage see the edit
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Whether this rewritten guidance is actually shown to any given user depends on the same unread tengu_flickering_rain setting.
Anthropic's documentation has since written up dangerouslyDisableSandbox, on Monitoring.