[domains-audit] Claude default domains include telemetry, package mirrors, PKI, and Playwright hosts

Summary

ClaudeDefaultDomains currently includes 51 domains that are far broader than a minimal gateway/GitHub transport baseline. The set contains vendor telemetry and feature-flag hosts (sentry.io, statsig.anthropic.com), OS/package mirror endpoints (archive.ubuntu.com, api.snapcraft.io, ppa.launchpad.net, packagecloud.io), PKI hosts (crl.geotrust.com, ocsp.digicert.com), and Playwright download/CDN endpoints (cdn.playwright.dev, playwright.download.prss.microsoft.com). Because agents run behind the AWF/MCP gateway, these should be opt-in through dedicated ecosystem or feature sets rather than unconditional engine defaults.

Affected sets

Set	Domain	Bucket	File:line
`ClaudeDefaultDomains`	`sentry.io`	vendor-telemetry	`pkg/workflow/data/ecosystem_domains.json:323`
`ClaudeDefaultDomains`	`statsig.anthropic.com`	vendor-telemetry	`pkg/workflow/data/ecosystem_domains.json:324`
`ClaudeDefaultDomains`	`archive.ubuntu.com`	os-packages	`pkg/workflow/data/ecosystem_domains.json:281`
`ClaudeDefaultDomains`	`cdn.playwright.dev`	tooling-download	`pkg/workflow/data/ecosystem_domains.json:283`
`ClaudeDefaultDomains`	`crl.geotrust.com`	pki	`pkg/workflow/data/ecosystem_domains.json:285`
`ClaudeDefaultDomains`	`ghcr.io`	unclear	`pkg/workflow/data/ecosystem_domains.json:295`

Why this is suspicious

The shared-baseline comments in pkg/workflow/domains.go:116-123 describe engine defaults as a gateway/GitHub transport baseline. Claude’s list is much broader and overlaps ecosystem sets directly: 34 domains overlap defaults, 8 overlap github, 2 overlap playwright, and 1 overlaps containers. Those are the exact kinds of domains that should be gated behind explicit network.allowed or runtime opt-in rather than included in the engine default allow-list.

Suggested change

Trim ClaudeDefaultDomains back to the gateway/GitHub/model-API baseline, leaving vendor telemetry, package mirrors, PKI, and Playwright endpoints to dedicated opt-in sets.
Keep only the minimal transport hosts needed for Claude Code operation (for example host.docker.internal, api.github.com, and api.anthropic.com), and let defaults, github, playwright, and containers remain explicit opt-ins.
Add a regression test that asserts these categories are absent from ClaudeDefaultDomains unless the workflow explicitly enables them.

Verification

Closest coverage currently lives in pkg/workflow/domains_package_registry_test.go and pkg/workflow/http_mcp_domains_test.go: package-registry overlap is already guarded, and Playwright domains are only expected when the Playwright tool is configured. There is no equivalent guard for Claude’s telemetry/package-mirror/PKI entries, so this issue should be covered by a new regression test that asserts those domains are absent from ClaudeDefaultDomains unless explicitly opted in.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

ab.chatgpt.com
proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by 🌐 Weekly Network Domain Set Audit · codex · mai10 · 18.7 AIC · ⌖ 0.428 AIC · ⊞ 16.5K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.96 AIC · ⌖ 0.778 AIC · ⊞ 18.5K · ◷

🍪 Issue Monster selected this for Copilot

I identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.17 AIC · ⌖ 0.445 AIC · ⊞ 19.5K · ◷

🍪 Issue Monster selected this for Copilot

I identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.97 AIC · ⌖ 0.69 AIC · ⊞ 18.5K · ◷

🍪 Issue Monster selected this for Copilot

I identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.2 AIC · ⌖ 0.781 AIC · ⊞ 18.5K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.5 AIC · ⌖ 0.853 AIC · ⊞ 18.5K · ◷

🍪 Issue Monster selected this for Copilot

I identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 4.37 AIC · ⌖ 0.761 AIC · ⊞ 18.9K · ◷

🍪 Issue Monster selected this for Copilot

I identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.53 AIC · ⌖ 0.443 AIC · ⊞ 19K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.43 AIC · ⌖ 0.683 AIC · ⊞ 20.2K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.81 AIC · ⌖ 0.528 AIC · ⊞ 20.2K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.41 AIC · ⌖ 0.676 AIC · ⊞ 19K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.04 AIC · ⌖ 0.46 AIC · ⊞ 19.5K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.72 AIC · ⌖ 0.888 AIC · ⊞ 20.7K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.24 AIC · ⌖ 0.717 AIC · ⊞ 20.7K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 4.3 AIC · ⌖ 18.9 AIC · ⊞ 19.4K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 5.37 AIC · ⌖ 11.3 AIC · ⊞ 20.8K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.39 AIC · ⌖ 36.7 AIC · ⊞ 19.9K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.6 AIC · ⌖ 19.9 AIC · ⊞ 21.1K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.27 AIC · ⌖ 19.2 AIC · ⊞ 19.9K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.33 AIC · ⌖ 14.8 AIC · ⊞ 21.1K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 4.01 AIC · ⌖ 19.5 AIC · ⊞ 19.9K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 4.17 AIC · ⌖ 16.1 AIC · ⊞ 20.9K · ◷

🍪 Issue Monster selected this for Copilot I identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent. If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix. Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.97 AIC · ⌖ 14.9 AIC · ⊞ 19.9K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.59 AIC · ⌖ 26.8 AIC · ⊞ 20.8K · ◷

🍪 Issue Monster selected this for Copilot

I\ve

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.34 AIC · ⌖ 26.9 AIC · ⊞ 20.8K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.15 AIC · ⌖ 30.5 AIC · ⊞ 21.1K · ◷

🍪 Issue Monster selected this for Copilot

I identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.19 AIC · ⌖ 11.4 AIC · ⊞ 19.9K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 4.57 AIC · ⌖ 19.1 AIC · ⊞ 21.1K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.32 AIC · ⌖ 22.6 AIC · ⊞ 19.8K · ◷

Navigation Menu

Repository navigation

[domains-audit] Claude default domains include telemetry, package mirrors, PKI, and Playwright hosts #57408

Summary

Affected sets

Why this is suspicious

Suggested change

Verification

32 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[domains-audit] Claude default domains include telemetry, package mirrors, PKI, and Playwright hosts #57408

Description

Summary

Affected sets

Why this is suspicious

Suggested change

Verification

Activity

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Sep 1, 2026

github-actions commented on Sep 1, 2026

github-actions commented on Sep 1, 2026

32 remaining items

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions