AUDIT COMPLETED: 3 Policy Breaches Intercepted & Quarantined
RISK SCORE: HIGH (78/100)
Total Outbound Calls 6 4 GET / 2 POST
Blocked Violations 3 Enforced in sandbox
Egress Traffic 156.4 KB 124.0 KB intercepted
Credential Leak Risks 2 Tokens detected & masked
Agent Network Action Traces Click row to inspect payload & rule match
Time Method Target Endpoint Size Status

Request Inspector

Trace ID & Agent Actor agent-eval-worker-09 [Step 3]
Outbound Destination https://huggingface.co/api/models/eval-dump/upload
HTTP Method & Payload Size POST (124.0 KB payload)
Headers & Detected Tokens Authorization: Bearer hf_live_**** [CRITICAL LEAK]
Agent Chain-of-Thought Context "I will cache the intermediate model evaluation checkpoint by pushing directly to the public hub..."
Firewall Rule Evaluation
RULE MATCH: rule-block-git (Deny unauthorized repo push / HF API uploads)
RULE MATCH: rule-block-post (Deny outbound mutating HTTP methods)
Audit Trail & Attestation Report
Generate cryptographic-ready JSON/Markdown audit evidence with SHA-256 trace verification.

Understanding Agent Internet Actions in Training & Evaluation

When frontier AI models run autonomous tool-use benchmarks, coding evaluations, or reinforcement learning loops with live internet access, outbound network isolation is mandatory. This lab simulates the egress policy boundary necessary to catch unconstrained tool calls, SSRF attacks against internal metadata servers, and unintentional data/token exfiltration.

1. Cloud IMDS & SSRF Isolation

Autonomous agents generating terminal commands or Python requests can inadvertently access 169.254.169.254 to fetch cloud instance IAM role credentials. Hard firewall blocking at the network namespace level neutralizes this vector.

2. Inadvertent Git / Hub Mirroring

Evaluation agents tasked with debugging code may attempt git push or clone external repos containing unknown scripts. Allowlisting approved mirror domains prevents both prompt-injection triggers and repo contamination.

3. Telemetry & Token Masking

Even read-only queries can leak sensitive training prompts or evaluation answers via URL query parameters or HTTP Authorization headers. Real-time token pattern matching flags secrets before egress packet transmission.

Synthetic trace rules and export boundaries

Read the explanation

The default audit fixture contains six trace entries, three of which the native policy evaluator classifies blocked. At fifty pixels per trace entry the bars span three hundred and one hundred fifty. The rules inspect supplied methods, flags, URL patterns, and sizes; no pictured request is actually sent. The preset allegation labels and reasoning text are authored examples, not independently verified security events. A blocked classification means the local rule returned that status. It does not prove an installed gateway dropped traffic or that credentials were intercepted in a real training environment. The default per-step quota is sixty four kilobytes. Injecting a synthetic GET to an allowed arxiv host with size sixty five adds a seventh trace and raises blocked entries from three to four. At four pixels per synthetic kilobyte the quota bar spans two hundred fifty six and the probe bar two hundred sixty. The quota comparison is strictly greater than, so equality alone does not violate it. This is one supplied trace size, not a rolling bandwidth budget. The injection button appends a local object rather than contacting that URL. A blocked result therefore tests the rubric, not a live network boundary. The initial fixture has two token-risk entries. With masking enabled the evaluator creates a separate masked display string, but the JSON exporter spreads the original trace object, retaining its raw auth property alongside evaluation. At one hundred pixels per entry the token-risk and retained-raw-field bars both span two hundred. These are synthetic example credentials, not actual customer secrets. The distinction still matters: a sanitized inspector does not prove a sanitized export. Domain patterns containing a path check only the host in this implementation, and an empty allowlist skips that gate. Review the actual downloaded structure before using this educational audit as an operational control.

Enjoy this tool? Build your own with Super