Claude daily update: verify network scope and choose a fallback model

Claude Code remains on version 2.1.220. GitHub and npm show no later user-facing features, so today's strongest Claude signal sits outside the changelog. On July 30, Anthropic described three real-world incidents caused when cybersecurity evaluations had unintended internet access. Over the following two days, Claude Status also reported several resolved disruptions affecting models and Claude surfaces.

Taken together, the signals expose two operating questions that must be answered before Claude works with real systems: where may the agent go, and what happens when the selected model does not respond?

Sources: Claude Code v2.1.220 on GitHub. Current Claude Code package in the npm registry.

Claude daily update: the evaluation environment reached real systems

Anthropic reviewed 141,006 cybersecurity evaluations where Claude may have obtained internet access. It found six runs across three incidents in which models reached real organizations' systems. The assigned tasks were capture-the-flag exercises, but a misconfigured environment had live internet access even though the prompt said the internet was unavailable.

A sandbox is an isolated runtime that should limit which files, processes, and network destinations an agent can reach. In these runs, that boundary was not sealed. Claude treated real targets as parts of the simulation and continued the task. Anthropic describes the events as closer to a harness and operational failure than a deliberate attempt by the model to escape.

This happened in dedicated evaluation infrastructure separate from Anthropic's sensitive internal systems and customer data. The models also ran without the standard safeguards used with generally available Claude models. The incidents therefore differ from an ordinary business workflow. The same operating rule still applies: a prompt can describe a boundary, but it cannot enforce network policy.

Source: Anthropic: Investigating three real-world incidents in our cybersecurity evaluations.

Let the runtime enforce the boundary

When Claude connects to real tools, the technical configuration should say the same thing as the assignment. Use an explicit list of permitted network destinations, scoped API keys supplied through environment variables or a secret manager, and test identities that cannot be confused with real customers or vendors.

An approval gate is a stop where a person must authorize a specific action before the workflow continues. Put it before external writes, publishing, payments, or production changes. Record network destinations, tool calls, model, and outcome in the run log. If the observed environment differs from the declared one, the run should stop rather than reason the difference away.

With those controls in place, Claude can receive real access to the systems the job requires. The firewall, permissions, and logs keep everything else outside.

Source: Anthropic's full incident review and response plan.

Fallback models and retries belong in the same run plan

Claude Status reported elevated errors across all models on July 29. On July 30, another incident affected claude.ai, the Claude API, Claude Code, and Claude Cowork, with different models recovering at different times. Claude Sonnet 5 then had degraded performance for 46 minutes on July 31. All incidents were resolved when their status posts were last updated.

A fallback model is a pre-approved model that takes over when the first choice is unavailable. Decide whether it may complete the whole task or only prepare a draft for review. If a call makes an external change, its retry must be idempotent, meaning the same request cannot create duplicate emails, records, or payments.

A useful run receipt records which model started, whether the fallback was used, which retries occurred, and whether the work completed fully or partially. The team can then work through a disruption without hiding what actually happened.

Sources: Claude Status: elevated errors across all models, July 29. Claude Status: elevated errors across many models, July 30. Claude Status: degraded performance on Claude Sonnet 5, July 31.

Try this prompt this week

Human step: Choose one Claude workflow that uses real tools. Put its architecture, authorization, network, model-routing, and run-log documents in the same workspace. Check the current Claude Status before a live test.

Read the documents for the selected Claude workflow.
Map allowed hosts, tools, data, write actions, primary model, and fallback model.
Compare the documents with actual configuration evidence and label every assumption.
Define stop conditions for a wrong network target, unavailable model, and partial completion.
Propose one read-only preflight without changing any settings.
End with owner, approval point, saved evidence, and pass or fail.

Good output should:

• Separate technically enforced boundaries from instructions in a prompt.
• Show when the fallback may continue and when a person takes over.
• Prevent retries from repeating an external write.
• Leave a short run receipt that someone can review afterward.

This is concrete Tool Forge work: give Claude the access its assignment requires, then build the boundary, fallback path, and evidence into the integration.