How to use this reference
Editorial lesson: evaluate egress as an authorization decision over session identity, receiving account, permitted operation and data purpose. A host allowlist is only one input. Keep enforcement independent of model instructions, minimize readable data, and retain provenance at the boundary that knows the session.
Before reading
- Basic access-control and service-identity concepts
- Distinguishing execution isolation from data-disclosure authority
Context and limits
- Anthropic reports limiting API proxy acceptance to provisioned-session credentials and adding egress restrictions; exact fix release/date and independent effectiveness verification are absent.
- No victim count, production-incident prevalence or individual award is established.
- Scope is only the Cowork approved-domain case, not other incidents or products discussed in the article.
- First-party engineering research; research-paper does not imply academic peer review.
Sources and provenance
- How we contain Claude across products Anthropic · reviewed 2026-10-06
Record reviewed 2026-10-06. Snapshot cb017eaea66e. Open the complete JSON contract.