{
  "id": 10479176,
  "title": "The Egress Security Your Environment Needs For Safe Agent Conduct",
  "url": "https://urgent.news/2026/09/28/the-egress-security-your-environment-needs-for-safe-agent-conduct",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-28T15:16:13.000Z",
  "source": {
    "name": "HackerNoon",
    "slug": "hackernoon",
    "url": "https://hackernoon.com/the-egress-security-your-environment-needs-for-safe-agent-conduct?source=rss"
  },
  "original_language": "en",
  "account": "In an environment where AI agents are increasingly used, a crucial aspect to consider is the egress control that ensures safe agent conduct. Traditionally, networks have focused on securing ingress traffic, but the reality is that outbound traffic poses a greater risk due to the non-deterministic actions of agents. These agents can reach out to various endpoints, such as model APIs, vector stores, SaaS tools, and even other agents, often on the public internet. In many cases, outbound traffic goes unchecked, leaving environments porous and vulnerable.\n\nOne of the primary issues with agent egress is that it relies on unpredictable software behavior. Unlike traditional software, agents dynamically choose which tools or models to call based on reasoning influenced by inputs that are beyond our control. This makes it challenging to create effective egress controls. A static list of allowed endpoints is insufficient, as it either becomes too restrictive, causing the agent to fail, or too permissive, turning the agent into a general-purpose outbound channel.\n\nAgents also exacerbate the risk of data exfiltration. Sensitive data, usually embedded in regular application content, can be exfiltrated through well-formed API calls to legitimate domains. Moreover, agent-to-agent and agent-to-tool calls create lateral traffic between workloads that previously had no reason to communicate, potentially extending the reach of a compromised agent. The most serious attacks in this category involve agents sending data out under the guise of valid credentials, a scenario seen in high-profile incidents like CamoLeak and AgentFlayer.\n\nTo address these challenges, the first step is to inventory all possible egress paths. This involves identifying every potential exit point, including internet gateways, proxies, peered networks, VPN tunnels, managed-service endpoints, DNS paths, and any developer-provisioned shortcuts. Once these paths are enumerated, they should be deliberately reduced to a smaller number of controlled exits. The fewer the paths, the easier it is to monitor and secure them.\n\nThe next crucial step is to enforce strict controls on these exits. The foundation should be a default-deny policy, which denies any traffic unless explicitly allowed. This approach inverts the traditional security mindset, focusing on what is allowed rather than what is forbidden. However, this strategy works best when source-based, meaning each workload is bound to specific destinations. This prevents a single compromised workload from having a broad impact across the entire network.\n\nImplementing a source-based allowlist requires visibility into the destination hostname, which is typically visible during the TLS handshake before encryption. In cases where the hostname is concealed using encrypted Client Hello, additional fallback mechanisms, such as IP address and reputation checks, are necessary. Additionally, blocking outbound DNS over HTTPS (DoH) and DNS over TLS (DoT) can help prevent agents from bypassing egress controls.\n\nIn summary, securing agent egress requires a comprehensive approach that starts with inventorying all possible exit points and culminates in enforcing strict, source-based controls. By minimizing the number of monitored exit paths and ensuring that only explicitly allowed connections are permitted, organizations can significantly mitigate the risks associated with AI agents and protect their environments from unauthorized data exfiltration.",
  "summary": "Control AI agent egress with verified identities, scoped destinations and data safeguards, while accounting for trusted-service and DNS bypass risks.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}