Network egress controls for AI agents

Network egress controls restrict what network connections an AI agent's runtime can make. They operate at the network level, below the application layer, providing a defense-in-depth measure against data exfiltration and command-and-control attacks.

Why application-level controls are not enough

Application-level controls (policy rules that restrict tool arguments) work for known tools. But an agent's runtime may have capabilities beyond the declared tools:

• The runtime process can make HTTP requests directly
• A compromised tool can open sockets
• Shell access enables arbitrary network connections

Network egress controls catch these cases because they filter all traffic from the process, regardless of how it originated.

Implementation approaches

Firewall rules

Configure iptables, nftables, or cloud security groups to restrict the agent's outbound traffic:

# Allow only specific destinations
iptables -A OUTPUT -d api.openai.com -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -d your-control-plane.com -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -j DROP

Network policies (Kubernetes)

If running in Kubernetes, use NetworkPolicy resources:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: agent-egress
spec:
  podSelector:
    matchLabels:
      app: ai-agent
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 10.0.0.0/8  # Internal services only
      ports:
        - port: 443
          protocol: TCP

DNS filtering

Restrict which domains the agent can resolve:

• Only allow resolution of approved domains
• Block resolution of all other domains
• Log all DNS queries for audit

This prevents data exfiltration via DNS tunneling and blocks connections to unknown destinations.

Combining with application-level controls

Network egress controls and application-level policy rules are complementary:

| Layer | What it controls | Granularity | |-------|-----------------|-------------| | Policy engine | Tool call arguments (URLs, paths) | Per-tool, per-argument | | Network egress | All TCP/UDP connections | Per-destination IP/port |

The policy engine catches misuse of legitimate tools. Network egress catches bypass attempts through uncontrolled channels.

Container isolation

Run agent processes in containers with restricted networking:

# Agent container with restricted capabilities
FROM node:20-slim
RUN apt-get update && apt-get install -y --no-install-recommends dumb-init
USER node

Use Docker network configuration or container runtime security profiles to enforce egress restrictions.

Monitoring blocked connections

Log blocked egress attempts. A spike in blocked connections may indicate:

• A compromised agent trying to phone home
• A prompt injection attempting data exfiltration
• A misconfigured tool trying to reach an unapproved endpoint

Route these logs to your security monitoring system for investigation.