---
title: "Allow agent network traffic only to listed · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/egress-allow-list
id: AID-73
level: Required
risk: data
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1113
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Allow agent network traffic only to listed hosts

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-73
- Level: Required
- Chapter: [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)
- Rule: Block every outbound connection from the agent's sandbox except to a written list of hosts, such as the package registry and the code host's API. The list holds no wildcard over a whole public domain.
- Check: From an agent session, `curl https://test.example.org` fails and a request to a listed registry works. A script reads the committed and managed settings. It fails on a wildcard over a public domain, such as `*.com` or `*.github.com`.
- Risk: Data leaked or lost
- How: An agent that has read hidden instructions sends what it found to a host the attacker controls. Without network access it cannot. Turn on the sandbox's network proxy and start with an empty list. Add each host the task needs, such as `registry.npmjs.org` or `pypi.org`. A broad entry, such as a public code host or a paste site, lets data leave through any account on it. Hosts the agent asks for during a session are refused, not approved on the spot. Lock the list in managed settings, as [Enforce the team's agent settings centrally](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/managed-agent-settings.md) says. Cloud agents have their own setting, such as the Copilot cloud agent firewall in the repository settings. The proxy checks host names only, so a listed host still sees what is sent to it. This is one leg of [break the lethal trifecta](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/lethal-trifecta.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JSON example

```json
{
  "sandbox": {
    "enabled": true,
    "network": {
      "allowedDomains": ["registry.npmjs.org", "api.github.com"],
      "allowManagedDomainsOnly": true
    }
  }
}
```

### TOML example

```toml
# Codex config.toml: the proxy refuses every host that has no allow rule
[features.network_proxy]
enabled = true

[features.network_proxy.domains]
"pypi.org" = "allow"
"files.pythonhosted.org" = "allow"
```

## Sources

- [Claude Code, configure the sandboxed Bash tool](https://code.claude.com/docs/en/sandboxing)
- [GitHub Docs, customize the agent firewall](https://docs.github.com/en/copilot/how-tos/use-copilot-agents/cloud-agent/customize-the-agent-firewall)
- [OWASP LLM Prompt Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html)

## Related rules

- AID-23 [Run agents in a sandbox](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/sandbox.md) in AI-assisted development
- AID-33 [Enforce the team's agent settings centrally](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/managed-agent-settings.md) in AI-assisted development
- APS-84 [Break the lethal trifecta](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/lethal-trifecta.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/egress-allow-list">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Run agents in a sandbox](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/sandbox.md)
- Next: [Skip approvals only in a throwaway sandbox](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/unattended-only-in-sandbox.md)
- [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)