Claude Code will now open a network host for one command and refuse it to the next

Anthropic added a per-command allowed_domains setting to Claude Code on 14 September, covering Bash, PowerShell and Monitor in auto mode with sandboxing.

The unit of the grant is the command, not the session. The changelog puts it plainly: “the hosts a command needs are reviewed with it and opened for it alone; other hosts are refused.” An approval to fetch from one domain therefore expires with the command that asked for it, instead of widening what everything after it can reach.

The same release adds omitClaudeMd to agent frontmatter, letting custom and plugin subagents start without user, project and local CLAUDE.md files while managed policy files still load, which separates instructions a repository can write from instructions an administrator can.

Three of the release’s Bash permission fixes describe checks that could be walked past: by a wildcard expanding to files the checker never saw, by an option the checker did not recognise, and by shell variable declaration flags misrepresenting the command being run.

The limit is in Anthropic’s own first line. This applies “in auto mode with sandboxing”, so anyone running with permissions bypassed gets none of it, which is most people running an agent unattended overnight. A network default that protects the cautious configuration and not the reckless one is worth having and is not worth relying on.