How is Claude Code's per-command allowlist different from allowing a domain for the session?

Claude Code 2.1.271 attaches allowed_domains to an individual Bash, PowerShell or Monitor command, and the hosts are reviewed at the same moment as the command itself. The grant does not carry over: a later command that wants a different host is refused unless it carries its own list.

Can an organization turn off fast mode in Claude Code Remote?

Yes. The release notes say fast mode applies in Claude Code Remote sessions, on cloud and self-hosted runners, only where your organization allows it. Within that, the setting comes either from the host's own fast-mode configuration or from typing /fast inside the session.

Why would you want a subagent to skip CLAUDE.md?

The new omitClaudeMd flag in agent frontmatter and --agents JSON lets a custom or plugin subagent start without user, project and local CLAUDE.md files, which keeps a narrow helper from inheriting a whole repo's instructions. Managed policy files still load, so org rules are not skipped with them.

What is the modelPricing multiplier in Claude Code for?

Claude Code 2.1.271 lets the modelPricing managed setting and the Claude apps gateway pricing block take a multiplier above 1, up to 10. It exists for organizations that bill model usage back to internal teams at a marked-up rate rather than at raw provider cost.

Anthropic · 2026-09-14 · major

Claude Code 2.1.271 — a sandboxed command only reaches its own hosts

Claude Code 2.1.271 adds per-command allowed_domains to Bash, PowerShell and Monitor in sandboxed auto mode, so each command gets network access only to the hosts reviewed with it. Fast mode also reaches Remote sessions.

Network permission moves from the whole session down to the single command that asked for it.

Quick facts

Maker	Anthropic
Version	2.1.271
Released	14 September 2026
Headline change	Per-command allowed_domains in sandboxed auto mode
Also new	Fast mode in Claude Code Remote sessions
Subagent flag	omitClaudeMd
Billing setting	modelPricing multiplier up to 10x

What is it?

Per-command allowed_domains is the headline of Claude Code 2.1.271. Bash, PowerShell and Monitor commands running in auto mode with sandboxing can now declare the hosts they need, and those hosts are reviewed together with the command and opened for that command alone. Every other host is refused.

How does it work?

The domain list sits on the command rather than on the session, so approving one curl does not widen the network for the next one. Alongside it, custom and plugin subagents gained an omitClaudeMd frontmatter flag that skips user, project and local CLAUDE.md files while still loading managed policy files, and claude plugin install and update gained --accept-command <sha256>, which accepts exactly the command a previous --json run printed instead of a blanket -y.

Why does it matter?

Anthropic has been shipping evidence that coding agents get pointed at real infrastructure, and a session-wide network grant is the blunt instrument in that picture. Scoping the grant to one command gives a reviewer something concrete to say yes to. The release also carries an administrative lever teams asked for: modelPricing now accepts a multiplier above 1, up to 10, for marked-up internal chargeback rates.

Who is it for?

teams running Claude Code under org policy

Frequently asked questions

How is Claude Code's per-command allowlist different from allowing a domain for the session?: Claude Code 2.1.271 attaches allowed_domains to an individual Bash, PowerShell or Monitor command, and the hosts are reviewed at the same moment as the command itself. The grant does not carry over: a later command that wants a different host is refused unless it carries its own list.
Can an organization turn off fast mode in Claude Code Remote?: Yes. The release notes say fast mode applies in Claude Code Remote sessions, on cloud and self-hosted runners, only where your organization allows it. Within that, the setting comes either from the host's own fast-mode configuration or from typing /fast inside the session.
Why would you want a subagent to skip CLAUDE.md?: The new omitClaudeMd flag in agent frontmatter and --agents JSON lets a custom or plugin subagent start without user, project and local CLAUDE.md files, which keeps a narrow helper from inheriting a whole repo's instructions. Managed policy files still load, so org rules are not skipped with them.
What is the modelPricing multiplier in Claude Code for?: Claude Code 2.1.271 lets the modelPricing managed setting and the Claude apps gateway pricing block take a multiplier above 1, up to 10. It exists for organizations that bill model usage back to internal teams at a marked-up rate rather than at raw provider cost.

Try it

https://github.com/anthropics/claude-code/releases/tag/v2.1.271