What
A subagent is a helper Claude Code starts to work on part of a task. When a subagent uses WebFetch to read a web page, you may be asked to approve it. If that request ends any way other than approval (it times out, expires or is denied), the subagent now gets a message written for it. The message tells it not to retry, to carry on without the page, and to report the blocked web address in its findings. Before, subagents got the same wording as the main conversation.
Why
This stops subagents trying the same fetch again and again when there is no way to ask you about it.
Names in the bundleWebFetch
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on Intercept and control agent behavior with hooks touched a line naming WebFetch after this was published.
| `matcher` | `string` | `undefined` | Pattern matched against the event's filter field, following the [rules for matchers in settings files](/docs/en/hooks#matcher-patterns). For tool hooks, that field is the tool name. Built-in tools inc…agent-sdk/hooks see the edit
Confirmed since
Anthropic's documentation has since written up WebFetch, on Error reference.
For the network lock, the warning names `sandbox.network.allowedDomains` and `allowManagedDomainsOnly`, and says `only allowed domains (and WebFetch domain rules) from managed settings are honored`.errors see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up WebFetch, on Error reference.