New `sandbox.filesystem.disabled` setting decouples filesystem isolation from network egress control

Claude Code Docs·medium signal

Claude Code 2.1.216 (July 20) added `sandbox.filesystem.disabled`, which skips filesystem isolation while keeping network egress control active. This matters for the common case where filesystem isolation breaks a build (toolchains that need paths outside the sandbox) and people respond by turning sandboxing off entirely — losing exfiltration protection along with it. Egress control is the half that stops a prompt-injected agent from shipping your secrets out; this flag lets you keep it while relaxing the half that was actually in your way. Combine it with a default-deny allowlist covering only api.anthropic.com and the package registries you genuinely need.