Agent Egress Audit Lab - AI Training & Eval Network Inspector

Run Configuration

EVAL-TRACE #04

Audit Incident Preset

Agent Egress Security Gate

Block Cloud Metadata (169.254.169.254 / IMDSv1/v2) Block Outbound POST/PUT/DELETE Payloads Deny Unapproved Repositories (git push / HF API) Inspect & Mask Auth Tokens / API Keys in Headers

Domain Allowlist (Comma Separated)

Max Egress Quota (KB per step)

Inject Synthetic Egress Probe

Sandboxed audit logs loaded. 6 outbound requests traced.

Total Outbound Calls 6 4 GET / 2 POST

Blocked Violations 3 Enforced in sandbox

Egress Traffic 156.4 KB 124.0 KB intercepted

Credential Leak Risks 2 Tokens detected & masked

Agent Network Action Traces Click row to inspect payload & rule match

Time	Method	Target Endpoint	Size	Status

Request Inspector

Trace ID & Agent Actor agent-eval-worker-09 [Step 3]

Outbound Destination https://huggingface.co/api/models/eval-dump/upload

HTTP Method & Payload Size POST (124.0 KB payload)

Headers & Detected Tokens Authorization: Bearer hf_live_**** [CRITICAL LEAK]

Agent Chain-of-Thought Context "I will cache the intermediate model evaluation checkpoint by pushing directly to the public hub..."

Firewall Rule Evaluation

RULE MATCH: rule-block-git (Deny unauthorized repo push / HF API uploads)

RULE MATCH: rule-block-post (Deny outbound mutating HTTP methods)

Audit Trail & Attestation Report

Generate cryptographic-ready JSON/Markdown audit evidence with SHA-256 trace verification.

Understanding Agent Internet Actions in Training & Evaluation

When frontier AI models run autonomous tool-use benchmarks, coding evaluations, or reinforcement learning loops with live internet access, outbound network isolation is mandatory. This lab simulates the egress policy boundary necessary to catch unconstrained tool calls, SSRF attacks against internal metadata servers, and unintentional data/token exfiltration.

1. Cloud IMDS & SSRF Isolation

Autonomous agents generating terminal commands or Python requests can inadvertently access 169.254.169.254 to fetch cloud instance IAM role credentials. Hard firewall blocking at the network namespace level neutralizes this vector.

2. Inadvertent Git / Hub Mirroring

Evaluation agents tasked with debugging code may attempt git push or clone external repos containing unknown scripts. Allowlisting approved mirror domains prevents both prompt-injection triggers and repo contamination.

3. Telemetry & Token Masking

Even read-only queries can leak sensitive training prompts or evaluation answers via URL query parameters or HTTP Authorization headers. Real-time token pattern matching flags secrets before egress packet transmission.