[BUG]Cowork network egress allowlist not working - custom domains blocked with 403 blocked-by-allowlist

[RogerMellie]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

What's Wrong?
Despite enabling network egress in Settings > Capabilities and setting the domain allowlist to "All domains", Cowork sessions continue to block external domains with 403 Forbidden errors. The MITM proxy returns blocked-by-allowlist even though all domains should be allowed.
Environment

Platform: Claude Desktop for macOS
Cowork feature preview (enabled)
Network settings: "Allow network egress" toggle ON, domain allowlist set to "All domains"

What Should Happen?

Requests to domains in the allowlist should succeed (200 OK).

Error Messages/Logs

Actual Behavior
All requests to external domains are blocked with:
HTTP/1.1 403 Forbidden
x-deny-reason: blocked-by-allowlist
The proxy logs show the domains are explicitly rejected by the MITM proxy filter, regardless of the "All domains" setting.
Error Details
Example blocking errors:
Failed to fetch https://draw.io/
Error: 403 Forbidden (x-deny-reason: blocked-by-allowlist)

Failed to fetch https://raw.githubusercontent.com/jgraph/drawio/dev/src/main/webapp/stencils/archimate32/strategy.xml
Error: 403 Forbidden (x-deny-reason: blocked-by-allowlist)
Related Issues
This appears related to (but distinct from):

#19087 - "Additional allowed domains" not included in JWT allowlist
#18854 - Cowork proxy blocking api.anthropic.com with blocked-by-allowlist
#21706 - "All domains" setting triggers validation errors

The core issue is that the MITM proxy on Claude Desktop isn't properly respecting the domain allowlist configuration for Cowork sessions, even when set to the most permissive "All domains" option. The sandbox proxy continues to block all external traffic.

Steps to Reproduce

Reproduction Steps

Go to claude.ai/settings/capabilities
Under "Code execution and file creation", ensure "Allow network egress" is enabled
Set "Domain allowlist" to "All domains"
Restart Claude Desktop
Open a new Cowork session
Attempt to fetch from external domains (e.g., draw.io, raw.githubusercontent.com via curl or web requests)

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

CoWork isssue.

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Impact
This significantly limits Cowork's usefulness for research, enterprise architecture diagramming, and any task requiring access to external resources (CDNs, documentation, diagramming tools, etc.).

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] Cowork VM network egress allowlist ignores Admin Capabilities settings #23818
2. [BUG] Claude Code on the Web .NET SDK binary downloads blocked by proxy even with "All domains" network access enabled #11897
3. Cowork sessions fail with 'Connection error' - internal MITM proxy blocking api.anthropic.com #18854

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[tylerwhardy]

Same issue via Claude Code remote execution (launched from Desktop app)

Reproducing this in remote container sessions started from Claude Desktop. The code executes server-side in a container (claude_code_remote), and the egress proxy JWT minted at session start still contains a hardcoded allowed_hosts field with ~100 specific domains — despite "All domains" being set in capabilities.

Deny reason in remote containers: x-deny-reason: host_not_allowed (vs blocked-by-allowlist on local Desktop proxy — may be two separate proxy implementations with the same root cause).

Decoded the session JWT and confirmed my custom domain is absent from allowed_hosts even in a session started 12+ hours after enabling "All domains". The policy change is not reflected in newly-minted JWTs.

Related to #19087. The JWT generation appears to be the common failure point across both execution environments.

[gethooo]

Same issue here. macOS, Claude Desktop 1.1.4328 (d8e391), 2026-02-25T17:04:36.000Z. Pro plan.

The VM boots fine and the API is reachable — the network itself is working. From cowork_vm_node.log:

[VM] Network status: CONNECTED
[VM] API reachability: REACHABLE
[VM:start] Startup complete, total time: 5444ms

But all non-API web requests are blocked by the egress proxy. Cowork reports "google.com is blocked by the network egress proxy" when asked to reach any external domain.

I've tried:

• "All domains" — blocked
• "Package managers only" + manually adding google.com — blocked
• Deleting vm_bundles, letting the VM rebuild — blocked
• Full quit and reopen between every settings change — blocked

[gethooo]

I dont know why this is marked as invalid, there are similar bugs listed.

[R0SSC0D3]

any update? Also having this issue.

[tylerwhardy]

#11897 This seems to be related

[salleizarg]

Noticed this issue about 8-9 days ago - thought a new session would fix this, it did not. Very persistent bug.