Claude's help documentation describes four network settings for code execution and file creation: off, package managers only, package managers plus named domains, and all domains. Defaults differ by plan. For most teams handling sensitive data, start with off or package managers only, and add domains only for a stated need.
What the feature does
According to the Claude Help Center, Claude can execute code to create and work with files in a conversation. You describe a spreadsheet, presentation, Word document or PDF in plain language, and Claude produces a file you can download. The page says code execution and file creation is available to Free, Pro, Max, Team and Enterprise users on the web, Claude Desktop and Claude Mobile.
That makes it one of the clearest real examples of the file generation and remote sandbox questions covered elsewhere in this series. The code runs in a sandboxed container, and the network setting decides what that container can reach.
Defaults by plan, as the page states them
| Plan | Feature default | Network default |
|---|---|---|
| Free, Pro, Max | Enabled by default per the page | Network access enabled, allowing package installs from approved sources |
| Team | Enabled by default; owners can disable | The page describes egress on, limited to package managers, in one place and disabled by default in another, so check your own settings screen |
| Enterprise | Enabled by default for new organizations; owners can disable | Disabled by default; owners can enable and set domain controls |
The Team plan wording on the page is not fully consistent between sections, which is a good reason to verify the actual state in your organization settings instead of relying on any summary, including this one.
The four network options
The page lists these options for Team and Enterprise owners, under Organization settings and Capabilities:
- Egress off. Claude uses pre-installed packages only, with no internet access. The page describes this as maximum security for sensitive environments.
- Package managers only. Claude can reach approved package managers such as npm, PyPI and GitHub to install software. The page describes this as the balanced default for those plans, with some advanced features potentially limited.
- Package managers plus specific domains. You add domains one by one for resources your organization needs.
- All domains. Full internet access except for domains on Anthropic's legal blocklist. The page calls this the riskiest option and points readers to its security considerations before enabling it.
Why the network setting matters
The page explains the reasoning in plain terms: disabling network access prevents data from leaving the sandbox even if something goes wrong. If network access is on, an attacker who gets instructions into the conversation, for example through a hostile document, could try to trick the model into sending data to an external site. This is the same pattern OWASP describes under excessive agency: damaging actions taken in response to manipulated model output, with permissions and functionality as root causes. Fewer reachable hosts means a smaller set of places data can go.
A worked example: choosing for three teams
Finance. Builds spreadsheets from internal exports containing customer data. No need to download anything at run time. Choose egress off. If a task needs a specific library that is not pre-installed, handle it by exception.
Data analysis. Needs common Python packages for charts. Choose package managers only. Review whether any task needs more, and add named domains only with a written reason.
Marketing. Builds decks from public material. Package managers only is likely fine. Resist the temptation to enable all domains for convenience.
Step by step: review your own settings
- Find the Capabilities page in organization settings and note whether code execution and file creation is on.
- Record the network option selected.
- If domains are listed, ask who requested each and why.
- Test: ask Claude to fetch a page from a domain you did not allow, using a harmless test, and see what happens.
- Check which user groups can use the feature and whether you can narrow it.
- Read the retention and sharing settings for generated files, using the questions in where AI-generated files live.
- Put a review date on the calendar, since settings and defaults can change.
What to tell staff
Admin settings only work if people understand them. A short note for users can say: files Claude creates are for review before they leave the company; do not paste secrets or regulated data into a request; if a task fails because a site is blocked, ask the owner instead of looking for a workaround; and report anything surprising, such as a file that contains data the person did not expect. Keep the note to ten lines, link it from the tool's welcome page, and update it when settings change.
Also decide who handles exception requests. A request to allow a domain should come with the task, the data involved and the duration. Approve it for a trial period, then review whether it is still needed. Over time this keeps the allowed list short, which is the whole point of the setting.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a guardrail sits between an assistant and the tools it calls, and which actions it can stop.
How this connects to Safeguard
Safeguard's MCP Guardrail and policies can add controls where an assistant reaches security tooling, and its compliance and evidence automation can hold the settings screenshots and review notes you collect. The Safeguard CLI can also write code, so the same questions about egress and approvals apply to any agent that edits your repositories.
Quick check
Is file creation on by default for every plan?
The Help Center page says it is enabled by default for each plan it lists, and that owners on Team and Enterprise can disable it. Check your own organization settings for the current state.
Does turning network access off stop all risk?
No. It limits where data can go from the sandbox. You still need to control which sources Claude can read and review the files it produces before sharing.
Who can change these settings?
The page says organization owners on Team and Enterprise plans manage them under Organization settings. Limit the number of owners and review changes.
Sources
Last reviewed: 19 October 2026.
