Agent Wranglers

AID-73Required

Allow agent network traffic only to listed hosts

Block every outbound connection from the agent's sandbox except to a written list of hosts, such as the package registry and the code host's API. The list holds no wildcard over a whole public domain.

By Agent Wranglers. Updated .

How to do it

An agent that has read hidden instructions sends what it found to a host the attacker controls. Without network access it cannot. Turn on the sandbox's network proxy and start with an empty list. Add each host the task needs, such as registry.npmjs.org or pypi.org. A broad entry, such as a public code host or a paste site, lets data leave through any account on it. Hosts the agent asks for during a session are refused, not approved on the spot. Lock the list in managed settings, as Enforce the team's agent settings centrally says. Cloud agents have their own setting, such as the Copilot cloud agent firewall in the repository settings. The proxy checks host names only, so a listed host still sees what is sent to it. This is one leg of break the lethal trifecta.

Examples

JSON example

{
  "sandbox": {
    "enabled": true,
    "network": {
      "allowedDomains": ["registry.npmjs.org", "api.github.com"],
      "allowManagedDomainsOnly": true
    }
  }
}

TOML example

# Codex config.toml: the proxy refuses every host that has no allow rule
[features.network_proxy]
enabled = true

[features.network_proxy.domains]
"pypi.org" = "allow"
"files.pythonhosted.org" = "allow"

How to check

From an agent session, curl https://test.example.org fails and a request to a listed registry works. A script reads the committed and managed settings. It fails on a wildcard over a public domain, such as *.com or *.github.com.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/egress-allow-list">Agent Wranglers AI-assisted development playbook</a>. In code you write, add a comment next to it with the same link.