--- title: "Claude Code v2.1.271: Per-Command Domain Allowlisting Is the Kind of Security Feature Nobody Announces" date: 2026-09-15 tags: ["claude-code","security","changelog","sandboxing","ai-tools"] categories: ["AI Tools"] summary: "Claude Code v2.1.271 (Sept 14) added per-command allowed_domains for Bash, PowerShell, and Monitor in auto mode with sandboxing, plus omitClaudeMd for subagents, fast mode in Remote sessions, and a marked-up pricing multiplier for internal chargeback. None of it got a launch post — it shipped as one changelog among 60-plus line items." --- ![Claude Code v2.1.271: Per-Command Domain Allowlisting Is the Kind of Security Feature Nobody Announces](/images/claude-code-v2-1-271-allowed-domains-sandboxing.png) Claude Code [v2.1.271](https://code.claude.com/docs/en/changelog) landed September 14 with no fanfare — no blog post, no benchmark table, just another dated entry in a changelog that now runs to dozens of items per release. Buried in that list is a feature that matters more than its one-line description suggests: per-command domain allowlisting for sandboxed auto mode. A day later, v2.1.272 shipped as a pure maintenance release. Here's what actually changed and why the sandboxing work deserves more attention than a changelog line gives it. ## The feature: `allowed_domains` per command, not per session Before this release, network access controls in Claude Code's sandboxed auto mode operated at a coarser grain — a session either had network access scoped to a broad allowlist or it didn't. v2.1.271 adds `allowed_domains` to Bash, PowerShell, and Monitor tool calls individually: when a command needs network access, the specific hosts it requires are reviewed alongside the command itself and opened for that command alone. Every other host stays refused, even for the rest of the same session. That's a meaningful tightening of the blast radius. Consider the difference in practice: a subagent running `npm install` needs `registry.npmjs.org`. A subagent running `curl` against an internal API needs exactly that API's host. Under the old session-level model, once a workflow's network scope was approved, any command in that session could, in principle, reach any host on the approved list — including one a later, compromised, or misdirected command didn't actually need. Per-command scoping means a `curl` call that suddenly wants to talk to an unexpected host gets refused on the spot, not waved through because an earlier, unrelated command already had network access approved. This is the same design principle Claude Code has applied to filesystem permissions for a while — scope the grant to what the specific action needs, not to the whole session — now extended to the network layer specifically for auto mode. It's worth naming that context explicitly: auto mode is the setting where Claude Code runs with the least per-action human confirmation, which is exactly where tightening the default blast radius matters most. ## `omitClaudeMd`: letting subagents run without inheriting instructions The second notable change is `omitClaudeMd`, now available in agent frontmatter and the `--agents` JSON config. It lets a custom or plugin-defined subagent run without loading user, project, or local `CLAUDE.md` files — while managed policy files (the ones an organization controls centrally) still load regardless. The use case is narrower than it might sound: a plugin author shipping a subagent designed to do one well-defined job (say, running a specific linter and reporting results in a fixed format) doesn't necessarily want that subagent's behavior perturbed by whatever a given repository's `CLAUDE.md` says about tone, commit conventions, or unrelated workflow preferences — instructions written for the primary agent, not for a narrowly scoped tool. `omitClaudeMd` lets that subagent's behavior stay predictable and testable regardless of which repository it's dropped into, while still respecting org-level policy that exists specifically to be inescapable. It's also a small, structurally relevant answer to a category of concern that's been live all year: if an untrusted or compromised `CLAUDE.md` can steer agent behavior (the premise behind CVE-2026-21852 and the broader CLAUDE.md-poisoning class this blog has tracked since April), giving specific subagents an explicit opt-out from inheriting it at all is one more way to shrink that attack surface for the agents that don't need repository-level instructions in the first place. ## The rest of the release Three other changes round out v2.1.271's feature list: - **Fast mode in Remote sessions** — fast mode, previously desktop/CLI-only, now works in Claude Code Remote sessions across both cloud and self-hosted runners, honoring whatever an organization's policy allows. - **`modelPricing` multiplier up to 10x** — the managed `modelPricing` setting and the Claude apps gateway `pricing` block now support a multiplier above 1, letting organizations set marked-up internal chargeback rates for cost allocation across teams. - **Auto-mode classifier changes** — two behavioral changes worth flagging together: a skill's or slash command's inline `!` shell commands now follow default-mode permission rules instead of being routed through the safety classifier, and a subagent now reports results back to its caller through a dedicated hand-back call that the classifier reviews directly, instead of reviewing the subagent's last message after the fact. Both are refinements to where and when the auto-mode safety layer actually inspects an action, rather than net-new capability. The maintenance-only v2.1.272 the following day (Sept 15) carries no itemized changes as of this writing — just "bug fixes and reliability improvements," consistent with Anthropic's pattern of following a substantial feature release with a quiet stabilization pass. ## A honest aside on `/ultrareview` Since this blog flagged [Claude Code's still-unpatched GitSpawn git-config sink in `/ultrareview`](/2026/09/gitspawn-claude-code-ultrareview-unpatched-rce/) just yesterday, it's worth checking whether v2.1.271 touched that path at all. It does — but not the vulnerability. The changelog lists a `/ultrareview`-related fix under Code Review: reopening a finished `/ultrareview` cloud session in the Claude app was restarting the whole review unprompted, which is now fixed. That's a UI/state bug, unrelated to the git-config execution sink Manifold Security disclosed. Nineteen releases past Manifold's last confirmed-unpatched check now, and the actual fix still hasn't shipped. Worth tracking until it does. ## Why this is worth writing about at all None of these individual items would justify a launch post on their own, and Anthropic clearly doesn't think they do either — that's exactly the point. Per-command network scoping in a sandboxed execution environment is genuinely careful infrastructure work, the kind of thing a security team would want to see from any tool running unattended commands against real systems. It shipped as one bullet among roughly sixty in a Tuesday changelog, sitting next to fixes for terminal rendering glitches and a PowerShell temp-path length bug. That's a consistent pattern this blog has now tracked across [multiple point releases](/2026/09/claude-code-v2-1-269-workflow-256-agents/) this year: capability and safety work that a marketing-first competitor would spend a keynote on, delivered instead as changelog prose written in plain, specific, unglamorous language. It's not a flashier story. It's the more trustworthy one. **Sources**: [Claude Code Changelog](https://code.claude.com/docs/en/changelog) (v2.1.271, Sept 14, 2026; v2.1.272, Sept 15, 2026; primary, direct fetch).