Egress Control: Where Can an Agent Connect?

This article has three layers:

1. Layer 1: The Intuition: A building with only one exit and a security guard at the door.
2. Layer 2: Real-World Use: Enterprise networks, cloud execution environments, and AI Agent practices.
3. Layer 3: Principles and Engineering details.

Layer 1: The Intuition

1.1 Only One Exit

If a building has a hundred exits and you have to station a person at every single one, leaks are inevitable. A better way is: open only one exit and have a security guard at the door to inspect everyone and everything allowed to leave.

The internet works the same way:

• Ingress control (who can connect in) is the familiar firewall;
• Egress control (where the programs inside can connect) is often overlooked, but it is crucial for preventing data exfiltration.

1.2 "Disallowing Internet Access" is much simpler than "Disallowing Specific Websites"

Layer 2: Real-World Use

• Enterprise Networks: In high-security environments, servers can only access the internet through an outbound proxy and only to addresses required for business operations. This prevents malware from connecting back to Command & Control (C2) servers and prevents data exfiltration.
• Cloud Code Execution Environments: Many AI product code execution features default to no internet access at all, or can only access limited package repositories through a controlled proxy.
• AI Coding Agents: A common practice is to allow access to code hosting, package repositories (npm, PyPI), and documentation sites, while denying everything else, or requiring user approval for every new domain.
• Data Loss Prevention (DLP) Systems: Enterprises inspect traffic content at the egress point to intercept requests containing sensitive data (ID numbers, private key formats).

Layer 3: Principles and Engineering

3.1 Implementation Methods

Another benefit of the proxy solution: the proxy can inject credentials. The Agent in the sandbox does not see the actual API keys; the proxy automatically adds them when forwarding requests (see "Credential Leakage and Context Window").

3.2 DNS Exfiltration

Even if all HTTP traffic is blocked, if the sandbox can still perform DNS queries, data can still leak:

Encode data into subdomains and query:
  6d7920736563726574.attacker-domain.com
The attacker controls the DNS server for this domain, allowing them to read the data from the query logs.

DNS queries typically pass through multiple layers of recursive resolvers before reaching the attacker's server, and firewalls may not intercept them.

Countermeasure: The sandbox should only use a controlled DNS resolver; the resolver only resolves allowlisted domains; or only the proxy is allowed to perform DNS resolution, while the sandbox itself cannot.

3.3 "Legitimate Websites" in the Allowlist can be abused

Allowlists typically include code hosting, documentation, and package repositories. The problem is that these websites themselves allow users to upload content:

Countermeasures:

• Use path-level rather than just domain-level rules—for example, allow downloading (GET) packages but disallow uploading;
• Credentials in the sandbox should have read-only permissions or only be allowed to push to specific repositories;
• Separately audit or require manual confirmation for write operations (POST, PUT, push).

3.4 Don't forget "Client-side Egress"

An Agent's output is ultimately displayed in the user's browser or terminal. If the output contains external resources that are automatically loaded (images, iframes), these requests are sent from the user's browser, completely bypassing the sandbox's egress control (see "Markdown Image Data Exfiltration"). Therefore, egress control must be managed at both ends: the sandbox's egress and the rendering end's CSP.

3.5 Default Deny

If the proxy is unavailable or the allowlist fails to load, the system should deny all traffic rather than allowing it (see "Fail-closed"). Every denied request should be logged: an injected Agent attempting to connect to an unknown address is itself a highly valuable alert signal.

Summary