You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
SandboxArea: what it touches
ImprovementsKind: in v2.1.304,
ImprovementsSection of the release
Unclear Which files the Windows sandbox can now read or write as a result is not stated.
What
The sandbox is a set of limits on what commands run by Claude can reach. On Windows, Claude Code sets it up by working out which files and folders the sandbox is allowed to use. That calculation now also takes the sandbox's credentials and its list of allowed network domains (allowedDomains) into account. Before, it was worked out from the sandbox configuration alone.
When TLS termination is turned on, setup also runs an extra first step. TLS termination means the sandbox opens up encrypted web traffic so it can be checked.
Why
This could change which files the Windows sandbox is able to read.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added sinceA small documentation edit on session-operations touched a line naming allowedDomains after this was published.You can update a session's `agent.tools` (csharp, go: `Agent.Tools`) and `agent.mcp_servers` (java, php: `agent.mcpServers`; csharp: `Agent.McpServers`; go: `Agent.MCPServers`), including permission policies and per-tool web settings such …managed-agents/session-operationssee the edit
Confirmed sinceAnthropic's documentation has since written up allowedDomains, on secure-deployment.Set `allowed_domains` (java, php: `allowedDomains`; csharp, go: `AllowedDomains`) on `web_fetch` to the sites the agent needs. Any URL the agent fetches can carry data to the site it points to, so this list is a security control. On `web_s…managed-agents/secure-deploymentsee the edit
How sure we are
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubtWhich files the Windows sandbox can now read or write as a result is not stated.
Anthropic's documentation agreesAnthropic's documentation has since written up allowedDomains, on secure-deployment.
