Agent Egress Control and Network Policy for AI Agents

Prompt injection is the case where text an agent reads is treated as an instruction it follows. Simon Willison's lethal trifecta names what makes that dangerous - private data, untrusted content, and the ability to communicate externally - and the threat model lives on prompt injection defense. Of the three, external communication is the only one you can revoke and still have a useful agent.

The question is how, not whether. Everything below assumes the agent runs in a container you control (sandbox environments), that its identity is scoped rather than shared, and that one policy covers a coding agent, a CI job and a browser-driving agent (computer use agents) alike.

Two honest positions, and the choice decides most of the design. The cheap one filters on the connection request only. Squid's peek-and-splice parses "the TLS Client Hello and extracts SNI (if any)," then splices the connection to "become a TCP tunnel without decoding the connection" (Squid project wiki). You get the hostname, you allow or deny on it, and no plaintext exists in your infrastructure.

The expensive one is that method and path rules are not expressible without decryption. They live inside the encrypted request, so a proxy enforcing them must terminate TLS and be trusted by the workspace - which is why coder/boundary injects a certificate. No third option filters on paths and preserves end-to-end encryption.

Interception is defensible when the workspace is ephemeral, the CA is minted per run, and only agent traffic crosses the proxy. It is not defensible when the path carries third-party or end-user data, the traffic is regulated, the CA would outlive the run, or a human developer shares the proxy. There, stay on SNI-only filtering and accept domain granularity.

If the agent holds the credential, any injection that reads an environment variable holds it too. Cloudflare's Sandbox SDK documents the alternative: "Your Worker issues a short-lived JWT token to the sandbox," and "The Worker validates the JWT and injects the real credential before forwarding the request," so that "Real credentials never enter the sandbox" (Cloudflare documentation). Note the scope: that is credential injection, not allowlisting, and the product docs say only that it is "Available on Workers Paid plan."

Pipelock, an open-source agent firewall covered by Help Net Security (May 4, 2026), states the same shape as a two-zone split. It "sits outside the agent at the egress boundary," so "the agent process holds the secrets and operates without direct network access, the proxy holds network access and no secrets, and all traffic crosses a scanning boundary between the two zones." Its repository dates from February 2026: a reference architecture, not a settled dependency. Which identity the proxy injects for is agent identity, on the zero trust assumption that the workspace is hostile.

default: deny            # anything not matched below is refused and logged

routes:
  - name: read-github-api
    match:
      domain: api.github.com
      method: [GET, HEAD]
    inject:
      header: Authorization
      secret_ref: vault://agents/repo-read   # resolved at the proxy, never in the workspace
    log: full

  - name: publish-release
    match:
      domain: api.github.com
      method: [POST]
      path: /repos/example-org/*/releases
    approval: human        # held until an operator approves
    inject:
      header: Authorization
      secret_ref: vault://agents/release-write
    log: full

  - name: internal-package-mirror
    match:
      domain: artifacts.internal.example.com
      method: [GET, HEAD]
    inject: none           # mirror needs no credential
    log: summary

Deny all egress from agent pods, then add back what is needed. The caveat that costs an afternoon: default-deny-egress also blocks DNS, so it needs an explicit allow to cluster DNS on UDP and TCP port 53.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-and-egress-proxy
spec:
  podSelector:
    matchLabels:
      role: agent-workspace
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24
    ports:
    - protocol: TCP
      port: 5978

Peers are only podSelector, namespaceSelector and ipBlock, which "selects particular IP CIDR ranges to allow as ingress sources or egress destinations." There is no hostname peer, and the project's list of what network policies cannot do includes "Targeting of services by name" and "The ability to log network security events (for example connections that are blocked or accepted)" (Kubernetes documentation). "Allow api.github.com" is not a sentence the API can express. One nuance is often stated wrongly: policy is already deny-by-default once it selects a pod; what is missing is explicit deny rules, so you cannot carve an exception out of a broad allow.

CIDR-based egress against a CDN-fronted service is therefore unworkable: the address set behind a code host or a registry is large, shared with unrelated tenants, and changes without notice, so any list you write is wrong within weeks. Use NetworkPolicy for the coarse shape and an L7 egress proxy or service mesh on top for host, method and path. See Kubernetes agent sandbox and network security.

Control Surfaces Compared

Egress control does not stop an injection succeeding. The agent still reads the poisoned comment and still acts on it; what changes is where the attempt terminates. The hardest remaining gap is exfiltration through an allowed destination. If the agent may push a branch or comment on an issue - and it must, or it cannot do the job - those are channels to anyone who can read them, and no rule tells a legitimate commit from one whose diff carries a secret.

Below that sit low-bandwidth channels that are close to unclosable: a branch name, a commit message, request ordering, timing, DNS lookups themselves. The proxy is also a single point of failure and a concentration of every credential it injects. Allowlists rot. Method and path rules exist only if you decrypt. And an agent inside a perfect allowlist can still write a subtle bug into a file it was legitimately allowed to edit, which no egress policy will ever see.