Abstract
Every other control in this series reduces the probability that an agent is compromised. Network egress control is different: it assumes compromise has already happened and asks a narrower, more answerable question — can the data actually leave? For a large class of attacks, the honest answer under deny-by-default egress is no, which is why this is the single most reliable backstop in the cluster.
We show why exfiltration and command-and-control both depend on outbound connectivity, catalogue the channels real attacks abused (trusted proxies, auto-fetched images, DNS), and lay out destination-aware, deny-by-default egress — including an honest account of the covert channels it does not fully close.
01The last line of defense
“The agent obeyed the attacker” and “the data left the building” are two different events. Egress control is the wall between them.
The strategic value of egress control is that its guarantee does not depend on out-guessing the adversary. You do not need to predict the injection, recognize the jailbreak, or classify the intent. You only need to know which destinations are legitimate for this workload — a small, stable, enumerable set — and refuse everything else. That refusal holds regardless of how the agent was compromised.
02Exfiltration and C2 both need the network
Two of the most damaging agent-attack objectives are fundamentally network-bound. Data exfiltration requires an outbound path to carry the stolen data. Command-and-control and reconnaissance require reaching external hosts. In GTG-1002, reconnaissance across ~30 organizations and the extraction of data were both network operations [2]; a deny-by-default egress posture would have starved both — the agent could plan the intrusion, but its packets would have had nowhere to go except allowlisted destinations.
03The channels attackers actually use
Real disclosures show attackers reaching for the trusted outbound paths that naive egress rules leave open:
The exfiltration rode the platform’s own image-proxy infrastructure: data was encoded into requests for signed proxy URLs, each resolving to a tracking pixel on attacker infrastructure, so the traffic looked like ordinary image loading and slipped past network controls [1]. Lesson: a trusted first-party domain can be a covert channel; allowlisting a domain is not the same as trusting every use of it.
The chain abused automatic fetching of referenced content to trigger outbound requests carrying data, without the user clicking anything [3]. Lesson:any feature that fetches a URL on the agent’s behalf is an egress primitive and must be governed like one.
Beyond these, the standard covert channels apply: DNS (encoding data in subdomain lookups), allowlisted SaaS APIs used as drop points, and timing/side channels. A serious egress design anticipates all of them.
04Deny-by-default egress
- Agent and sandbox have no default route; the only exit is a mediating proxy.
- Proxy enforces a destination allowlist (host and path where possible), not just IP ranges.
- DNS is controlled — resolve only allowlisted names through the proxy; block arbitrary lookups to kill DNS exfiltration.
- Every request is logged to the audit spine for anomaly detection and forensics.
- Features that fetch URLs (images, link previews, webhooks) route through the same proxy and count against the allowlist.
05Destination-aware, not just on/off
The CamoLeak lesson is that coarse allowlisting fails: permitting a trusted domain wholesale lets an attacker abuse legitimate endpoints on it. Destination-aware policy narrows to the specific endpoints a workload uses and, where feasible, constrains request shape — a travel agent may POST to the booking API’s reserve endpoint, but not exfiltrate a megabyte of data to an analytics beacon on the same allowlisted CDN. The finer the granularity, the fewer covert channels survive.
06Covert channels and honest limits
Egress control is powerful but not total. Low-bandwidth covert channels — timing, encoding secrets into otherwise-legitimate allowlisted requests, staging data through a permitted SaaS API — can leak small amounts even under deny-by-default. The open question is how much residual leakage is acceptable and how to detect slow exfiltration through legitimate channels. Egress control raises the cost and caps the bandwidth of exfiltration dramatically; it does not reduce it to a mathematical zero. Treat it as the strongest available backstop, not a proof of impossibility.
07Open, allowlist, or proxy-only?
| Egress posture | Exfiltration risk | Operational cost | Where it fits |
|---|---|---|---|
| Open egress | Unbounded | None | Never for agents with data access |
| IP/domain allowlist (coarse) | Reduced; proxy-abuse remains | Low | Minimum bar; insufficient alone (CamoLeak) [1] |
| Proxy-only, host+path allowlist, controlled DNS | Low; covert channels only | Medium | The default for production agents |
| Air-gapped / no egress | Near-zero | High; breaks many tasks | Highest-sensitivity, offline-capable agents |
Make proxy-only egress with host+path allowlisting and controlled DNS the default for any agent that touches sensitive data. It closes the trusted-proxy and DNS channels that real attacks used while remaining operable. Reserve full air-gapping for the most sensitive workloads. Pair egress control with the mediation plane’s audit spine so slow, in-channel leakage has a chance of being detected.
08Production failure modes
The agent has unrestricted outbound network access
Mechanism
The agent (and any code it runs) can open arbitrary outbound connections. After a successful injection, it encodes and ships data to an attacker destination — often via a trusted proxy, auto-fetched URL, or DNS.
Why the existing control failed
The sandbox isolated filesystem and processes but did not enforce a destination-aware egress policy; “isolated” did not mean “cannot phone home.”
Signals to monitor
- First-seen external destinations, especially in sequence
- Data-shaped requests to image proxies / analytics beacons
- Unusual DNS query volume or high-entropy subdomains
- Outbound volume inconsistent with the task
Controls
- Deny-by-default egress via a mediating proxy
- Host+path allowlist; controlled DNS resolution
- Route URL-fetching features through the same proxy
- Log all egress to an isolated audit spine for detection
09Limitations
- Egress control assumes compromise and bounds consequence; it does nothing to prevent the compromise itself and must be paired with the upstream controls in this series.
- Low-bandwidth covert channels (timing, encoding into legitimate allowlisted requests) can leak small amounts even under deny-by-default; it is a strong backstop, not an impossibility proof.
- Fine-grained host+path allowlisting is operationally heavier and can break on legitimate endpoint changes, creating pressure to loosen it.
- The cited incidents demonstrate channel abuse but do not quantify how often egress controls would have fully prevented impact in the wild.
10Where this leads
Egress is the outermost ring of the containment architecture and the backstop behind prompt injection, coding-agent, and MCP compromise. To judge how urgently you need it, read how fast offensive capability is actually growing in exploitation benchmarks.
—References
- Legit Security; GitHub. CamoLeak — GitHub Copilot Chat private source-code exfiltration (CVE-2025-59145). Security disclosure (CVE-2025-59145), 2025. https://www.legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code
- Anthropic. Disrupting the first reported AI-orchestrated cyber espionage campaign (GTG-1002). Anthropic — Primary disclosure, 2025. https://www.anthropic.com/news/disrupting-AI-espionage
- Aim Security; Microsoft (MSRC). EchoLeak — zero-click indirect prompt injection in Microsoft 365 Copilot (CVE-2025-32711). Primary security disclosure (CVE-2025-32711), 2025. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711
- OWASP. OWASP Top 10 for LLM Applications & Agentic AI Threats and Mitigations. OWASP GenAI Security Project, 2025. https://genai.owasp.org/
Engineering assistance
ProxyTech works with engineers and teams building production AI, cloud, security, data and distributed systems. If this analysis maps to a system you are designing or operating, we provide hands-on support and interview preparation for these domains.