Claude Code 2.1.219 adds `sandbox.network.strictAllowlist` — deny non-allowlisted hosts with no prompt at all

Claude Code Docs·medium signal

The new `sandbox.network.strictAllowlist` setting makes sandboxed commands deny any non-allowlisted host outright instead of prompting the user to approve it. That matters because the prompt itself was the weak link: agent egress is the documented exfil path in Claude Code's sandbox, and prior bypasses (including a SOCKS5 hostname null-byte injection that defeated wildcard allowlists across ~130 releases before being silently fixed in v2.1.90) all ended in a network connection a tired human waved through. Turn it on for any agent that touches credentials or private source, and pair it with a narrow explicit allowlist rather than wildcards.