Infrastructure

Anthropic's Claude Code Artifacts deliberately blocks the backend — and that's the point

A new live-dashboard feature for Claude Code Team and Enterprise users ships with a hard 16 MiB cap, no external network calls, and no persistent storage. The constraints are the product.

Written by Mara Voss · Bureau Tech · Jun 19, 2026

The constraint is the feature

Anthropics's new Artifacts capability for Claude Code does something counterintuitive for an enterprise product launch: it ships with an explicit list of things it will never do. The published documentation is direct — "an artifact is a capture of work, not an application" — and the technical implementation enforces that position. Every Artifact is a single HTML file, capped at 16 MiB rendered size, wrapped in a Content Security Policy (CSP) that blocks all external network requests. No `fetch`, no XHR, no WebSockets. All CSS and JavaScript must be inlined; images must be embedded as data URIs.

That is not an oversight. It is Anthropic's answer to a specific enterprise problem: how do you let an AI coding agent share live, visual context with non-technical stakeholders without creating a new data-exfiltration surface?

What it actually does

When an engineer is working inside a Claude Code session — available on Team and Enterprise subscription tiers — the agent can now spin up a shareable web page directly from the session's context: the local repository, connected monitoring tools, and the conversational reasoning already in progress. The page updates in place as the agent works, at the same URL, without requiring the engineer to wire up external infrastructure or export anything manually.

Boris Cherny, the lead creator of Claude Code, described his own use in a post on X: "visual explanations of tricky code, system diagrams, quick previews of a few animation options, data analyses and dashboards I share with the team."

Every published Artifact generates a version history, so teammates can track the agent's progress or roll back to an earlier state. Access is gated to authenticated members of the publishing engineer's organization; there is no mechanism to make an Artifact publicly accessible. Org-level administrators control the feature through role-based toggles and retention policies, with oversight available via a compliance API.

How it compares to OpenAI Codex Sites

OpenAI shipped a broadly similar-sounding feature — Codex Sites — roughly two weeks earlier, but the architectural choices diverge sharply.

Codex Sites generates Cloudflare Worker-compatible ES modules and supports persistent backend infrastructure: D1 relational databases for structured data and R2 object storage for file uploads. A Codex Site can support public sign-ins, integrate with external identity providers, and apply granular access controls down to custom user groups. OpenAI also provides a dedicated panel for managing runtime environment variables and secrets, so sensitive keys stay out of source files. The two-stage publishing process — a reviewable candidate linked to a Git commit before production deployment — is designed for durable internal tooling.

The gap is not a matter of one product being more mature. They are solving different problems. Codex Sites is positioned to replace functional internal SaaS tools. Claude Code Artifacts is positioned to replace the status-update meeting.

Licensing and what enterprises actually own

Both features ship under closed, proprietary licenses. That means enterprise customers do not hold code-level ownership over the rendering engine (Anthropic) or the integration nodes (OpenAI). Neither can be independently forked or self-hosted — a meaningful consideration for organizations with strict data-residency or vendor-lock-in policies.

Both vendors have responded to that exposure with access controls rather than portability. Anthropic's org-level compliance API and default-private posture are the primary mitigations. OpenAI's workspace-level RBAC and secrets management serve the same function on a more complex attack surface, given that Codex Sites can expose public-facing URLs.

The tradeoff in plain terms

If your team needs a live, secure visual layer on top of an active engineering workflow — something a product manager can open on a phone without touching the codebase — Claude Code Artifacts is a direct fit. If you need that output to persist, authenticate external users, or evolve into a standalone internal tool, Codex Sites is the closer match, with the corresponding increase in infrastructure complexity and attack surface.

Key takeaways

Claude Code Artifacts generates a single self-contained HTML page (capped at 16 MiB rendered size) from an active session; it cannot call external APIs, load remote scripts, or persist form data.
Artifacts are private by default and visible only to authenticated members of the same organization — they cannot be made public to the broader internet.
OpenAI's competing Codex Sites feature takes the opposite architectural stance: it supports Cloudflare Worker-compatible ES modules, D1 relational databases, R2 object storage, and public sign-in flows.
Both features ship under proprietary licenses; enterprise customers cannot fork or self-host the rendering infrastructure.
The feature is available on Claude Team and Enterprise plans; Boris Cherny, Claude Code's lead creator, confirmed the rollout on X.

FAQ

Which Claude subscription plans include Artifacts for Claude Code?

Artifacts for Claude Code is available on Claude Team and Enterprise subscription plans, according to Anthropic's announcement.

Can a Claude Code Artifact be shared publicly outside an organization?

No. Artifacts are private to the author by default and, when shared, are accessible only to authenticated members of the same organization. Anthropic's documentation states they cannot be made public to the broader internet.

Why can't a Claude Code Artifact call external APIs or load remote resources?

Anthropic wraps each Artifact in a strict Content Security Policy (CSP) that blocks all external network requests — including fetch, XHR, and WebSocket calls. All scripts, styles, and images must be self-contained within the single HTML file. This is a deliberate security boundary to prevent live data from leaving the corporate environment.

What is the file size limit for a Claude Code Artifact?

Each Artifact is capped at 16 MiB rendered size, as specified in Anthropic's published documentation.

How does Claude Code Artifacts differ from the Artifacts feature in Claude's consumer web chatbot?

Anthropic first introduced Artifacts in its consumer web interface in summer 2024, where it allowed users to publish code snippets and small interactive projects. The Claude Code version integrates directly into the CLI and desktop app, drawing on a live session's full repository context and connected data sources, and adds org-level access controls and version history suited to enterprise workflows.

Can enterprises self-host the Claude Code Artifacts rendering infrastructure?

No. Both Claude Code Artifacts and OpenAI Codex Sites operate under proprietary licenses and run exclusively within their respective vendors' managed infrastructure. Enterprise customers cannot fork or self-host either rendering engine.

Citations

Anthropic's Claude Code Artifacts update brings live, shared dashboards and interactive workspaces to enterprisesClaude Code Artifacts is available on Team and Enterprise plans; each Artifact is a single HTML page capped at 16 MiB with a strict CSP blocking all external network requests; Anthropic documentation states 'an artifact is a capture of work, not an application.'
Boris Cherny on X — Claude Code Artifacts launch postBoris Cherny, lead creator of Claude Code, described using Artifacts for 'visual explanations of tricky code, system diagrams, quick previews of a few animation options, data analyses and dashboards I share with the team.'
VentureBeat — OpenAI Codex Sites coverageOpenAI released Codex Sites more than two weeks before Anthropic's Artifacts announcement; Codex Sites supports Cloudflare Worker-compatible ES modules, D1 relational databases, R2 object storage, and public sign-in flows.