Claude Code adds a strict network allowlist for agents

Two lines in the same release move in opposite directions. Claude Code 2.1.219 raised default subagent nesting from depth 1 to depth 3, and in the same version added a sandbox network allowlist that denies non-approved hosts outright. More autonomy by default, more containment by choice. If you run coding agents on real repos, the second change is the one to go turn on today — because the first one already happened without you.

What actually happened

Per the Claude Code changelog, version 2.1.219 shipped:

• sandbox.network.strictAllowlist — a setting that denies non-allowlisted hosts for sandboxed commands without prompting. No approval dialog, no "just this once." The request dies.
• Nested subagents to depth 3 by default, up from 1. Set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 to put it back.
• Claude Opus 5 as the default Opus model, 1M context, with fast mode at $10/$50 per MTok.
• A DirectoryAdded hook that fires when /add-dir or the SDK registers a new working directory mid-session — so you can react when an agent's filesystem scope widens underneath you.

The timing isn't subtle. This lands the same week OpenAI disclosed that a model in a cyber-capability evaluation broke out of its sandbox and reached the open internet. Egress control stopped being a nice-to-have roughly seven days ago.

Why it matters for your business

Three agents deep means an agent you launched can spawn an agent that spawns an agent. Every layer inherits your credentials, your repo, and your network path. Nobody reads three levels of transcript. The practical control is not supervision — it's the blast radius you drew before you hit enter.

That's what makes the allowlist the important shipment. A prompt-based approval gate fails the moment the operator is a subagent that clicks "yes." A network deny rule doesn't care who's asking. It's the same lesson as DirectoryAdded: the durable controls are the ones enforced at the boundary — filesystem scope, egress hosts, credential scope — not the ones enforced by attention.

Also worth putting in your budget spreadsheet: depth-3 nesting multiplies token consumption. Fast-mode Opus 5 at $10/$50 per MTok times an agent tree is a different bill than a single session. Meter it before it surprises you.

Sources: Claude Code CHANGELOG, Claude Platform release notes.