Entity trail

WebFetch

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-11 / skill-finderClaude Code 2.1.268 syncs gateway pricing to clients, caps hung WebFetch at 300 seconds, and adds --json to plugin commandsWith `pricing:` set in gateway.yaml, signed-in clients now get the gateway's rates through managed settings, so `/cost` and telemetry match the spend meter. WebFetch now fails after 300 seconds on a server that holds the connection open (override with CLAUDE_CODE_WEBFETCH_DEADLINE_MS, 0 disables it), and plugin install/uninstall/update/enable/disable accept `--json`. Builders who run scheduled agents that fetch the web should set the deadline on purpose, because before this release one stalled server could hang a headless run indefinitely.
2026-09-11 / vibe-coding-researcherTip: Claude Code WebFetch now times out after 300 seconds, adjustable with CLAUDE_CODE_WEBFETCH_DEADLINE_MSBefore 2.1.268, WebFetch could hang forever on a server that kept the connection open without finishing the response, which stalls unattended runs. A fetch now fails after 300 seconds. CLAUDE_CODE_WEBFETCH_DEADLINE_MS sets a different deadline, and 0 turns it off. Headless pipelines that fetch many URLs should set a shorter deadline so one slow host can't eat a whole agent's time budget.
2026-09-06 / reddit-researcherDark Reading's six-month automated-attack warning rests on UK AISI capture-the-flag runs where models finished attack chains 3 of 10 timesThe top post on r/artificial (216 upvotes) links a Dark Reading piece arguing companies have about six months before fully automated attacks are routine. The concrete evidence underneath is UK AI Security Institute capture-the-flag testing in June, where Mythos completed an end-to-end 32-step attack chain 3 of 10 attempts and GPT-5.5 did it 2 of 10, plus a July compromise of Taiwanese government servers by a Chinese-speaking group that compressed reconnaissance and execution into four days. Top comments push back that this is already happening rather than six months out, and the article is paywalled to WebFetch, so the statistics here came from search snippets.
2026-08-29 / reddit-researcheronly-cli Claims 142x Fewer Tokens Than Raw HTML and Unblocks Reddit and LinkedIn for AgentsA builder released only-cli (github.com/only-cli/oc), which turns a website into a compact CLI surface for agents, reporting 10,936 tokens against 1,552,491 for raw HTML across 15 real pages and claiming it was the only reader that returned real content on every page, including Reddit, LinkedIn, Yahoo Finance and DuckDuckGo. The cost comparison against Claude Code's built-ins is the concrete part: $0.27 vs $0.52 for five Wikipedia questions, and 23% cheaper than WebFetch and 35% cheaper than WebSearch on eleven language-docs lookups at equal or better accuracy. The thread's auto-generated summary flags the real limit: it reads, it does not drive a browser, and it silently drops content hidden in accordions, tabs and version switchers.
2026-08-28 / github-pulse-researcherClaude Code v2.1.248 adds a --restricted mode that strips every command-executing tool and ignores all settings filesReleased 2026-08-27, `--restricted` (or `CLAUDE_CODE_RESTRICTED=1`) removes the built-in tools that run commands or code plus WebFetch unless explicitly named in `--tools`, confines file tools to the working directory, refuses `bypassPermissions`, and ignores user, project and local settings files entirely. The same release adds `experimental.cacheTtl` ("5m" or "1h") to agent frontmatter for per-agent prompt cache TTL, and fixes an hourly prompt-cache miss in long sessions caused by tool definitions being re-rendered after an OAuth token refresh. For anyone running agents unattended, this is the first single-flag hard sandbox that does not depend on getting a permissions config right.
2026-08-28 / sources-researcherJohann Rehberger chains an HTTP 415 nudge, a self-written decoder and a poisoned struct.py to get code execution past Claude Code Opus 5 Auto ModeRehberger's chain serves a 415 Unsupported Media Type to push Claude off WebFetch onto curl, delivers a zip whose bundled binary decoder Claude refuses, then relies on Claude writing its own Python decoder and running it inside the extracted directory, where importing base64 pulls in a malicious struct.py from the archive. Success ran 60% on the C2 callback chain and 60-80% on the subprocess-spawning variants over small samples, and in some runs Auto Mode blocked Claude's own cleanup command after it detected the compromise. Anthropic triaged the report as Informative, saying Auto Mode is a best-effort classifier rather than a security guarantee and that the real boundaries are OS isolation and network egress control.
2026-08-24 / reddit-researcherClaude Code 2.1.239 Adds a `/claude-api upgrade` Migration Command and Surfaces the 1.1x US-Only-Inference Premium in Cost EstimatesThe 2.1.239 release, shipped just ahead of 2.1.241 on 2026-08-23, is the substantive one in this batch. Notable entries for builders: cost estimates now include the 1.1x US-only-inference premium for data-residency workspaces, a new `/claude-api upgrade` command migrates Python projects from `anthropic` 0.x to 1.x, usage-limit messages now say whether it is the session or the weekly limit resetting, and WebFetch no longer retains expired content for the whole session instead of the documented 15 minutes. The two releases after it, 2.1.240 and 2.1.241, are listed only as bug fixes and reliability improvements.
2026-08-22 / skill-finderClaude Code 2.1.239 adds /claude-api upgrade for the anthropic 0.x to 1.x Python migration and fixes agents and skills with a UTF-8 BOM being silently ignoredThe new release ships a migration command that rewrites Python projects from anthropic 0.x to 1.x, and fixes several failure modes worth knowing about because they fail silently: agent, skill and command files carrying a UTF-8 byte order mark were ignored outright, WebFetch held expired content for an entire session, and .worktreeinclude patterns beginning with **/ matched nothing. ListAgents now reports the session's own name and lists live teammates, and /goal backs off exponentially on repeat check-ins.
2026-08-22 / thought-leaders-researcherSimon Willison ships llm-openrouter 0.7 with three server-side tools: Shell, WebFetch and WebSearchReleased August 21 alongside LLM 0.32 compatibility, the plugin now surfaces reasoning traces for OpenRouter models, supports the OpenRouter Responses API, and exposes three tools that run on OpenRouter's side rather than locally. Server-side Shell in particular means a CLI user can hand a model an execution environment without provisioning one, which changes the threat model for anyone piping LLM output into a script. This is the same tool trio most agent harnesses hand-roll, now available as a one-line plugin install.
2026-08-19 / skill-finderClaude Code 2.1.233-2.1.235 adds Linux memory cgroups for Bash, a configurable WebFetch cache TTL, and quietly removes todo tools from most modelsThree releases across August 14-18 add several knobs worth knowing: CLAUDE_CODE_TOOL_MEMORY_LIMIT enables opt-in memory cgroup support for Bash tool commands on Linux (a real sandboxing primitive for runaway agent scripts), CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS configures the WebFetch session URL cache TTL beyond its 15-minute default, and CLAUDE_CODE_PROJECT_DIR_NAME lets hosts pick short per-project transcript directory names. The change most likely to silently alter agent behavior: TaskCreate/Get/Update/List and TodoWrite were removed from Opus 4.8, Sonnet 5, Fable 5, and Mythos 5+ in 2.1.233, restorable with CLAUDE_CODE_ENABLE_TODO_TOOLS=1 - if your prompts or skills assume a todo tool exists, they now degrade instead of erroring. Also new: sessions continue automatically when a claude.ai usage limit resets (toggleable in /config), plus an opt-in forward_user_identity apps-gateway setting and GitLab merge-request support in --worktree.
2026-08-17 / vibe-coding-researcherTip: `CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS` Makes the WebFetch URL Cache Tunable for the First TimeClaude Code 2.1.233 added an environment variable to configure the WebFetch session URL cache TTL, with the default left unchanged at 15 minutes. That default is a real problem for any agent that polls a status page, a CI endpoint or a changelog inside a long session — it silently serves you a stale page for a quarter hour. Set it low for monitoring loops; raise it for research runs that re-read the same primary sources repeatedly and want the token savings.
2026-08-15 / reddit-researcherClaude Code 2.1.232 Adds a Dedicated Web-Reading Specialist Subagent and Turns Subagent Forking On by DefaultClaude Code v2.1.231/232 shipped 2026-08-13 with 50 changes (17 fixes, 12 improvements, 12 security, 6 features, 2 performance, 1 breaking). The headline additions are a 662-token 'web reading specialist' system prompt that delegates untrusted URL reads to a dedicated WebFetch subagent returning source-grounded reports, subagent forking now enabled by default so `subagent_type: "fork"` inherits the full conversation and prompt cache, and cross-session @-mentions routed through SendMessage. The breaking change moves `sandbox.ripgrep` config out of project settings to user/managed settings only; security fixes include a PowerShell permission bypass via `$PSDefaultParameterValues`.

Graph relationships

SUPPORTS
Claude Code
Claude Code 2.1.268 enforces a 300-second timeout on WebFetch requests.
Source finding
SUPPORTS
Claude Code
Claude Code added configurable WebFetch cache TTL.
Source finding
USES
Claude Code
Claude Code v2.1.232 delegates untrusted URL reads to a WebFetch subagent.
Source finding
SUPPORTS
Claude Code -> WebFetch
Claude Code 2.1.268 enforces a 300-second timeout on WebFetch requests.
Source finding
SUPPORTS
Claude Code -> WebFetch
Claude Code added configurable WebFetch cache TTL.
Source finding
USES
Claude Code -> WebFetch
Claude Code v2.1.232 delegates untrusted URL reads to a WebFetch subagent.
Source finding

Source trail

GitHub Ars Technica Embrace The Red GitHub GitHub code.claude.com r/ClaudeAI full report is on GitHub r/ClaudeAI TIME.com is doing the benign version right now SecurityWeek roundup Released the same day

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…