Tip: Restrict Which Sites a Managed Agent Can Reach With `allowed_domains` and `blocked_domains`
Claude Platform Release Notes·medium signal
Claude Managed Agents now accept `allowed_domains` or `blocked_domains` on the `web_search` and `web_fetch` entries in the `agent_toolset_20260401` `configs` array. `web_fetch` also takes `max_content_tokens` and `web_search` takes `user_location`. This is the cheapest available defense against indirect prompt injection through fetched pages: pin the agent to the handful of domains it actually needs rather than trusting it to ignore whatever a hostile page tells it.