Lock Your Agent's Web Searches to a Domain Allowlist — A One-Config Fix for Indirect Prompt Injection

TL;DR: Managed Agents' allowed_domains and blocked_domains config on web_search and web_fetch restrict which URLs your agent reads — a single config change that removes the long tail of arbitrary web content from the indirect prompt injection attack surface.

When your agent uses web_search or web_fetch, it reads content written by people who know (or can guess) that an agent is reading it. Indirect prompt injection is the attack where a page embeds text designed to redirect the agent's next action. You don't need to know every attacker's technique to defend against most of them: just restrict which sites the agent can reach to the ones it actually needs.

The config (shipped August 19):

# On agent creation or update
tools=[{
    "type": "agent_toolset_20260401",
    "configs": [
        {
            "name": "web_search",
            "allowed_domains": ["docs.anthropic.com", "github.com", "pypi.org"]
        },
        {
            "name": "web_fetch",
            "allowed_domains": ["docs.anthropic.com", "github.com"],
            "max_content_tokens": 50_000
        }
    ]
}]

A listed domain covers that host and all subdomains. allowed_domains and blocked_domains cannot both be set on the same entry. A web_fetch call for a non-allowed URL returns is_error: true to the agent; web_search silently omits non-allowed results.

The limits: this is a mitigating control, not a complete defense. An adversarial page on an allowed domain — a comment section on GitHub, a user-editable wiki — can still inject. Combine allowlisting with a tightly scoped system prompt, output validation, and human-in-the-loop checks on actions with side effects.

Sources: Restrict web search and web fetch domains — Anthropic Managed Agents docs · Indirect prompt injection attacks — Simon Willison · OWASP LLM Top 10: Prompt Injection