Topic · DiggingBeagle record
Agent isolation requires bounding indirect outbound authority through allowed services
Allowlisting one egress service is insufficient when the service can itself request external URLs, return sensitive data or relay content on the caller's behalf.
- Topic kind
- pattern
Definition & limits
An apparently closed execution network can still reach other destinations transitively through metrics collectors, authentication helpers, DNS handlers or service-originated fetch APIs. The original rule constrains immediate connections but may not constrain follow-on requests initiated by the allowed intermediary. OpenAI's simulated compromised-host red teaming provides a concrete account of this boundary class. The finding is not evidence that every host was compromised or that blocking the network alone can prevent CPU cache channels. Audits should model transitive fetch and credential authority per allowed service and distinguish observability from prevention.
OpenAI's frontier red-team study starts from a host-compromise assumption when testing the external egress layer. A direct destination denylist is insufficient if an approved metrics or identity service can be induced to fetch the blocked URL and relay a response. The two edges must be checked separately: compromised host to permitted intermediary, and intermediary to external target. Logging only the first permitted request may miss the final action, while treating the test as an unprompted production breach would overstate the evidence.
Examples
- [Host-assumed-compromised egress testing](db:CASE-2026-OPENAI-TRANSITIVE-EGRESS-BYPASS).
- [Initial training sandbox DNS egress](db:CASE-2026-OPENAI-TRAINING-DNS-EGRESS).