| Status | Target & Method | Agent Context / Tool Action | Matched Rule | Risk Tier |
|---|
During self-play, RL evaluation, and agentic training loops, foundation models generate shell commands, Python scripts, and tool calls. Without strict kernel-level egress filtering (via eBPF, Squid, or network namespaces), agents can:
This sandbox simulates an egress interception layer using three complementary mechanisms:
The saved egress auditor evaluates request fixtures entirely inside the browser. Its first check is air gap: every request returns block immediately when that mode is selected. The animated first route stops at the gate, while the second continues only to illustrate evaluation when air gap is off. Cloud metadata protection comes next and searches both parsed hostname and the entire URL for the literal metadata address. Payload key inspection follows, returning quarantine for recognized token patterns. Webhook quarantine then precedes protocol, read-only and domain rules. Only the first matching rule supplies the verdict. A secret-bearing HTTP request may therefore show quarantine rather than the later HTTP block. The animation represents this early return in the saved code, not actual network packets. No request is sent to the destination and no operating system firewall is configured. In allowlist only mode, a literal star permits every parsed hostname unless an earlier check rejects it. A pattern beginning star dot strips those two characters and accepts either the root hostname itself or a hostname ending in dot plus that root. The illustrated api dot example dot com follows the allow path. Badexample dot com stops because its suffix lacks the required separating dot. Example dot com itself also passes the wildcard pattern. Literal entries match the whole lowercase hostname exactly, not paths or arbitrary suffixes. These comparisons execute only in allowlist mode. Open or read-only modes do not consult that list. Webhook detection uses substring checks for its known service names, a broader rule that may match unrelated hostnames containing those strings. The animation explains the saved string logic and should not be mistaken for comprehensive URL validation or a security audit. The HTTP switch is read by the evaluator and blocks HTTP when unchecked. SSH protocol or a CONNECT method is blocked when the git SSH switch is unchecked. Read-only mode accepts only exact GET and HEAD method strings. By contrast, the visible HTTPS and raw sockets switches are attached to change listeners and exported as configuration, but their checked values are not read by evaluateRequest. The first animated route stops for the tested HTTP rule; the second illustrates that the missing HTTPS test does not itself stop evaluation. Earlier rules and the allowlist can still reject that HTTPS request. This discrepancy describes the saved source without changing the tool. The JSON export records settings and generated policy notes; it does not install enforcement. For a probe URL containing the word token, the form supplies a synthetic HF_TOKEN equals hf_test123 payload; other URLs use an empty payload. That short synthetic value does not meet the key detector requirement of at least twenty alphanumeric characters after the hf prefix. The URL-only probe therefore does not accept a real caller-supplied payload and cannot demonstrate complete payload inspection. A matching displayed verdict or moving canvas packet is simulator output, not evidence that a live agent or host network is contained.