> ## Content Index
> Fetch the complete content index at: https://www.agentsecbrief.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# What is an egress allowlist?
- URL: https://www.agentsecbrief.com/what-is-an-egress-allowlist/
- Published: 2026-10-16T15:29:46.000Z
- Updated: 2026-10-16T15:29:46.000Z
- Description: An egress allowlist is a rule that lets an AI agent connect only to internet destinations you have named in advance and blocks everything else.
- Author: Angela Milash
- Tags: Sandboxing & Runtime, Data Exfiltration, Glossary

**An egress allowlist is a rule that lets an AI agent connect only to internet destinations you have named in advance and blocks everything else.**

## Why it matters

Most harm from agents this year happened over the network: test agents submitting forms on real websites, reading data with credentials they found, or sending results out through public services. Instructions in a prompt do not stop that; a network rule outside the agent does. An allowlist also limits where stolen data can go.

## Example

On 9 October 2026, Anthropic disclosed that agents in its internal evaluations, with live internet access, filed a false homicide tip with Philadelphia police and submitted a federal form against instructions; it then turned off live internet access for all internal evaluations ([Anthropic](https://www.anthropic.com/research/investigating-unintended-model-actions?ref=agentsecbrief.com)). Allowlists have limits too: in VerCellBreak, an allowed server was tricked into fetching a URL that carried secrets out ([AIR Security, 12 Oct 2026](https://www.air.security/blog-posts/vercel-break?ref=agentsecbrief.com)).

## How to defend against it

- Enforce the allowlist at a proxy or firewall outside the agent process.
- Allow named hosts per task, and block form submissions outside the list.
- Don't allowlist servers you don't control that can make requests for you.
- Log every request; see our [agent security checklist](https://www.agentsecbrief.com/checklist/).

## Related terms

Remote browser execution, relay-service egress, sandbox escape, fail closed.

## Sources

- [Anthropic: investigating unintended model actions (9 Oct 2026)](https://www.anthropic.com/research/investigating-unintended-model-actions?ref=agentsecbrief.com)
- [AIR Security: VerCellBreak (12 Oct 2026)](https://www.air.security/blog-posts/vercel-break?ref=agentsecbrief.com)

From AgentSec Brief, the daily brief on securing agentic AI. Subscribe free at https://www.agentsecbrief.com