Build1 publisher2 min readPublished
Anthropic documents two conflicting network egress defaults for Claude Team plans
Code execution and file creation is enabled by default on every Claude plan, and the same support article lists Team network egress as disabled in one section and on for package managers in another. Owners get four egress settings, and three of them allow outbound traffic.
The Engineer · Build desk
What happened
- Claude executes code inside the chat to produce Excel spreadsheets with working formulas, PowerPoint presentations, Word documents and PDFs that the user downloads directly.
- Team organisations and new Enterprise organisations also get code execution and file creation on by default, with organisation owners able to disable it in organisation settings.
- Anthropic's page says code runs in an isolated sandboxed container, and that with network access on, prompt injection could theoretically trick Claude into sending data to external servers.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- decision An owner who wants to know the Team egress default has to open Organization settings > Capabilities and read the toggle, because the article answers the question two ways.
- exposure The tiers with no administrator are the ones whose sandbox has an outbound path from the first session, so the exfiltration route Anthropic describes exists unless the account holder closes it.
- cost Reaching the state Anthropic says removes the risk is an administrative job per organisation, and on Free, Pro and Max it falls to each individual subscriber.
Anthropic's support page states the remedy in absolute terms: "Disabling network access eliminates this risk entirely" [16]. That setting is the first of four. With egress off, Claude runs with pre-installed packages only and no internet access, which the page calls maximum security for sensitive environments [10]. A team in that mode still builds Excel models, creates presentations and analyses data, according to the same page [16].
The second setting is the documented default for organisations: package managers only, reaching npm, PyPI, GitHub and similar approved sources [11]. The caveat attached to it reads "This balances functionality with security, but some advanced features may be limited" [11]. Above that, owners can add individual domains to a whitelist [12]. At the top, all domains gives full internet access except Anthropic's legal blocklist, which the page calls the riskiest option [13]. Three of the four settings permit outbound traffic [19].
Which of those an existing Team organisation sits in depends on which part of the article you read. The availability list says network access is disabled by default for Team and Enterprise, with owners able to enable it in organisation settings [5]. The setup section says Team plans are enabled by default at the organisation level "with Allow network egress toggled on with access to package managers only" [8]. For Enterprise, the setup section says egress is toggled off for new organisations, which matches the availability list [7]. The Team entry is the one that disagrees with itself, so the toggle in Organization settings > Capabilities is the only statement of the default an owner should trust [8].
Consumer plans carry a smaller version of the same problem. On Free, Pro and Max, the availability list says network access is enabled so Claude can install packages from approved sources [3]. The instructions for those same plans tell the user to toggle Code execution and file creation on under Settings > Capabilities, and to toggle Allow network egress on to reach external data sources [9]. A default you have to switch on is an unusual sort of default. Domain whitelisting and the four-way egress control are documented for Team and Enterprise owners [18].
The Enterprise default is described for new organisations [6][7]; the article does not say what existing Enterprise organisations inherit. Individuals get the same switch on mobile, by tapping their initials or name in the left sidebar, opening Settings, and selecting Capabilities [17].
What to watch
- Whether Anthropic corrects the availability list or the setup section so the Team egress default reads the same way in both places.
- Whether domain-level egress control reaches Pro and Max, where the article documents whitelisting for Team and Enterprise owners only.
- The truncated "A phased approach to network access" section, and what rollout it describes once the page carries the full text.