Claude Managed Agents' web_fetch now fetches only URLs that already appear in the session
Since 7 October 2026, the web_fetch tool in Claude Managed Agents fetches only URLs that have already appeared in the session[1]. Examples are URLs in the text of a user message, in a web_search result, or in a page that web_fetch returned earlier[1].
A URL that appears only in Claude's own output, the agent's system prompt, an attached document, or the output of a tool such as bash, read or an MCP tool does not count[1]. A web_fetch call for it returns a url_not_in_prior_context error result to the agent[1].
Anthropic says the change reduces the risk of data exfiltration[1]. To let the agent fetch a URL, send it in the text of a user.message event[1].
In a cloud environment with limited networking, allowed_hosts now also applies to web_search and web_fetch[1]. Environments with unrestricted networking and self-hosted environments do not limit these two tools[1].
A web_fetch call for a URL on a host that allowed_hosts does not match returns a url_not_allowed error result[1]. web_search omits results from such hosts[1]. When allowed_hosts lists no hosts, neither tool returns a page or a search result[1].
allow_package_managers and allow_mcp_servers add no hosts for these two tools[1]. To let the tools reach a host, add it to allowed_hosts[1]. That also opens the host to the sandbox[1].
With limited networking, creating a session fails with a 400 error when an enabled web_search or web_fetch tool has an allowed_domains entry outside allowed_hosts[1]. A session update that adds such an entry fails the same way[1].
An allowed_hosts entry matches one exact host unless it starts with *.[1]. If allowed_hosts holds only example.com, docs.example.com is not within it[1].
To fix the 400 error, add the host to allowed_hosts or remove the entry from allowed_domains[1].