Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

Claude Cowork (Local Agent Mode) fails with "API Error: Connection error" when attempting any request. The request hangs for several minutes before timing out.

Claude Code CLI works perfectly fine in the same environment, confirming network connectivity to Anthropic servers is not the issue.

What Should Happen?

Claude Cowork should successfully connect to the API and process requests, just like Claude Code CLI does.

Error Messages/Logs

From ~/Library/Logs/Claude/claude.ai-web.log:

2026-01-13 13:46:35 [error] Refused to connect to 'https://a-api.anthropic.com/v1/m' because it violates the following Content Security Policy directive: "connect-src 'self' https://api.segment.io https://*.segment.io https://*.segment.com https://a-cdn.anthropic.com https://*.google.com https://*.facebook.com https://*.facebook.net https://*.doubleclick.net".

2026-01-13 13:46:35 [error] Fetch API cannot load https://a-api.anthropic.com/v1/m. Refused to connect because it violates the document's Content Security Policy.

2026-01-13 13:46:35 [error] Error sending segment performance metrics TypeError: Failed to fetch

Steps to Reproduce

1. Open Claude Desktop app (version 1.0.3218)
2. Open a folder with Cowork (Local Agent Mode)
3. Send any message, e.g., "How many files are in this folder?"
4. Observe the request hangs for several minutes
5. Eventually fails with "API Error: Connection error"

Note: Claude Code CLI works fine in the same directory with the same request.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

2.1.5

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Root cause analysis:

The Claude Desktop app's embedded web view has a Content Security Policy (CSP) that does not include a-api.anthropic.com in the connect-src directive. When Cowork attempts to make API calls to this endpoint, the browser's CSP enforcement blocks the request.

The CSP whitelist includes:

• api.segment.io, *.segment.io, *.segment.com
• a-cdn.anthropic.com
• *.google.com, *.facebook.com, etc.

But it does NOT include:

• a-api.anthropic.com (the actual API endpoint Cowork needs)

This is why Claude Code CLI works (it doesn't use a browser/CSP) while Cowork fails.

Environment:

• macOS Darwin 25.2.0 (arm64)
• Claude Desktop version: 1.0.3218
• Claude Code SDK version: 2.1.5
• All network connectivity tests to Anthropic servers pass via curl/ping
• Disabling QUIC (--disable-features=EnableQuic) did not resolve the issue