When Claude runs code to create files, network egress decides whether that code can talk to the internet. Team and Enterprise owners can choose no network access, package managers only, package managers plus chosen domains, or all domains. Anthropic's page calls all domains the riskiest option.
The four levels
From Anthropic's file creation help article, owners can pick:
- No network access.
- Package managers only.
- Package managers plus specific domains.
- All domains.
Enterprise defaults to network access off for new organizations. Free, Pro and Max start with it on.
Why the risk exists
The page warns that malicious instructions hidden in external files or websites could trick Claude into running untrusted code or sending data from its context, such as project files, MCP data or Google integrations, to third parties. Network egress is the path data would leave on.
Egress is not the only exit
The same page says MCP connections can still communicate externally even when network egress is disabled. Cowork's help article likewise says web fetch, web search, MCPs and Claude in Chrome are not governed by egress permissions. Turning egress off is one control among several, not a wall.
Mitigations Anthropic lists
The page names user control, action summaries, audit capabilities, no public sharing of conversations with file artifacts for Free, Pro and Max users, task and session time limits, no shared sandboxes between users, and a prompt injection classifier. It also recommends monitoring Claude during use and stopping it if it accesses data unexpectedly.
A sensible policy
- Start at package managers only.
- Add domains one at a time, with a named reason.
- Avoid all domains except for isolated experiments.
- Review which connectors are on, since they bypass egress rules.
How to explain this to a team
A short rule helps: nothing sensitive goes into a chat that has untrusted files or live web access. If a task needs both, split it into two sessions.
For wider reading, Claude MCP tool poisoning shows how hidden instructions in tool descriptions work. Safeguard provides policies, gates and a free scan at gold.safeguard.sh/scan.
Where to look in your settings
Owners on Team and Enterprise find the capability toggle under Organization settings, Capabilities, and the separate Allow network egress option sits beside it. Individual users on Free, Pro and Max see a similar switch in their own Settings. Check both after any plan change, because the file creation page itself notes an inconsistency about Team defaults, and the safest approach is to read what your own account shows rather than assume.
Revisit the setting whenever a new connector, skill or workflow is added, because each one changes what a hidden instruction could reach.
Quick check
Does disabling egress block MCP traffic?
No. The help page says MCP connections can still communicate externally.
Which option does Anthropic call riskiest?
Allowing all domains.
Sources
- Create and edit files with Claude (Claude Help Center)
- Get started with Claude Cowork (Claude Help Center)
Last reviewed: 19 October 2026.
