Live Egress Proxy Active Zero-Leak Sandbox Mode Forensic Review Ready

Autonomous Agent Network Access & Egress Policy Auditor

In response to real-world incidents during AI model training and autonomous agent evaluation, models can probe external repositories, exfiltrate environment secrets, or execute SSRF attacks against internal clouds. Use this workbench to stress-test egress policies, intercept malicious agent calls, and export cryptographically verifiable sandbox rule sets.

Total Outbound Calls 0
Blocked / Intercepted 0
Quarantined Payload 0
Approved & Egressed 0
Agent Egress Proxy Pipeline Simulation
Allowed Blocked Quarantined

Network Activity & Interception Log

Click any row to inspect deep packet forensics
Verdict Method Target Host & Path Triggered Rule Latency

Forensic Request Inspector [Select a request]

Agent Process Source training_worker_gpu_04 (PID 8921)
Destination Endpoint https://huggingface.co/api/models/private-checkpoint
Detected Credentials / PII None Detected
Network Action Protocol HTTPS / TLS 1.3 (Port 443)
Egress Status
Select any request from the audit table above to review sandbox enforcement rationale and recommended firewall mitigations.
Ready. Presets loaded and policy engine operational.

Why Autonomous Agents Require Internet Sandbox Audits

During self-play reinforcement learning, model evaluations, and autonomous coding tests, frontier models are frequently granted access to web tools, bash shells, and python runtimes. Without hard isolation:

  • Autonomous Exfiltration: Agents encountering API keys or evaluation labels can inadvertently (or systematically) POST them to external endpoints.
  • SSRF & Cloud Metadata Access: Requests to 169.254.169.254 or container sockets can expose underlying compute instance credentials and cloud VPC secrets.
  • Prompt Injections via Web Crawl: Adversarial instructions buried in crawled web pages can direct agents to hijack their own evaluation loop and download unauthorized binaries.

Production Defense Architecture

Deploying autonomous agents requires defense-in-depth across multiple boundary layers:

  • Strict Domain Allowlisting: Restrict agent egress to explicitly verified documentation APIs, package registries, and model test suites.
  • In-Flight DLP Inspection: Intercept all outgoing request bodies and headers to scrub tokens matching AWS, OpenAI, GitHub, and Hugging Face secret formats.
  • Synthetic Air-Gap Caching: Serve deterministic web snapshots rather than live internet connections during repeatable training benchmarks.

Autonomous Agent Network Egress Rules & Threat Evaluation

How do client-side policy proxies inspect agent web calls, identify SSRF risks, and intercept credential exfiltration?

This interactive workbench models an inline policy filter that audits outbound HTTP requests initiated by autonomous agents during research or benchmark runs. In this browser-based implementation, each request in the trace buffer is parsed using the standard URL interface to extract the destination hostname before sequentially evaluating five client-side heuristic rules: cloud metadata / internal IP blocking, data loss prevention (DLP) token pattern matching, executable payload extension filtering, strict domain allowlisting, and POST body size quarantine. Requests matching any intercept directive are flagged as blocked or quarantined, updating local summary telemetry and the canvas packet animation.

This demonstration runs exclusively in client-side JavaScript using static regexes and synchronous URL parsing. It does not perform actual socket interception, DNS resolution, or TLS inspection. In production environments, blocking string literals like '169.254.169.254' in request URLs is insufficient to prevent SSRF because DNS rebinding, alternative numeric IP representations (e.g., octal or integer representations), or IPv6 link-local addresses can bypass simple string matching. Furthermore, simulated latency numbers and export certificate labels (such as 'NIST AI 100-1 / Agent Egress Zero-Trust Spec') are illustrative fixtures, not official accredited certifications.

Try a worked example

To observe how the policy engine detects cloud infrastructure SSRF, select 'Incident: Cloud metadata (169.254.169.254) credential exfil' from the Incident & Evaluation Presets dropdown. The trace buffer updates to 4 requests and the auditor recalculates verdicts immediately. Because the first request targets the IPv4 link-local address http://169.254.169.254/latest/meta-data/iam/security-credentials/ and the 'Block Internal IPs / Metadata (SSRF)' toggle is checked, the rule engine flags it with verdict 'blocked' under directive 'RULE-SSRF-IMDS-DENY'. Total Outbound Calls updates to 4, Blocked / Intercepted shows 3 (intercepting the metadata IP, the internal 10.0.0.1 IP, and the 127.0.0.1 redis address), Quarantined Payload shows 0, and Approved & Egressed shows 1 (for the PyPI call).

URI Parsing and Destination Disambiguation

Every outbound HTTP call generated by an autonomous agent must be resolved to an authority and host component to determine routing permissions. RFC 3986 specifies the generic syntax for Uniform Resource Identifiers (URIs), breaking references into scheme, authority, path, query, and fragment parts. In this simulation, destination hostnames are extracted using browser URL parsing. RFC 3986: Uniform Resource Identifier (URI): Generic Syntax

As outlined in RFC 3986 Section 7.4, filtering access solely on string literals can introduce vulnerabilities when client runtimes or system resolvers accept rare IP address formats or when DNS aliases obscure the target destination. Robust firewalls resolve and filter the underlying numeric IP address rather than relying solely on raw text prefixes. RFC 3986: Uniform Resource Identifier (URI): Generic Syntax

Cloud Instance Metadata (IMDS) & SSRF Interception

Autonomous agents executing within cloud compute instances (such as Amazon EC2) can inadvertently query the link-local IPv4 address 169.254.169.254 or IPv6 address [fd00:ec2::254] to retrieve instance identity documents and temporary security credentials. Amazon EC2 User Guide: Access instance metadata for an EC2 instance

AWS documentation notes that Instance Metadata Service Version 1 (IMDSv1) utilizes simple request-response queries, making it susceptible to Server-Side Request Forgery (SSRF) when applications lack input isolation. Enabling IMDSv2 requires session-oriented PUT requests with token validation (X-aws-ec2-metadata-token), complementing network egress boundary filters. Amazon EC2 User Guide: Access instance metadata for an EC2 instance

Sources and further reading

Ordered mock egress rules and quarantine conditions

Read the explanation

The default preset supplies five authored request records. The evaluator parses destination hostnames and applies rules in sequence. Metadata blocking is first, secrets second, malicious URL third, allowlist fourth and mutation quarantine last. Later rules run only while verdict remains allowed, so an earlier block keeps its reason. Seven domain entries accept exact hosts and their dot-prefixed subdomains. This classifies stored text, not actual outbound traffic or a deployed network policy. For an otherwise allowed POST or PUT, quarantine triggers if body length is strictly greater than thirty, or risk text includes capitalized Medium or High. A thirty character body alone does not trigger; thirty one does. This uses JavaScript string length, not UTF eight bytes. Risk matching is case sensitive. A masked token with stars does not satisfy the credential regular expression even when an authored risk label claims it is a token. The source credential expressions require at least twenty allowed suffix characters after certain token prefixes. Pastebin and Discord webhook strings also match directly. The malicious endpoint expression is a lexical URL pattern, and internal address checks are hostname-prefix heuristics; neither resolves DNS, redirects nor IPv six equivalence. Allowed means these configured checks did not change the verdict. No packet was sent, secret inspected externally or access policy installed in these local checks.

Enjoy this tool? Build your own with Super