Tool-calling agents are only as safe as their network. A sandbox that can reach the open web will eventually fetch something you did not intend, especially when tools accept URLs from model output. Isolate sandbox egress for tool-calling agents before demos become incidents worth explaining.
Egress allowlists turn vague trust into a short list of hosts. Everything else fails closed. That is boring infrastructure, and it is what keeps agent experiments from becoming data loss stories that outlive the feature.
Default deny, then name every host
Start with no outbound access. Add package registries, model APIs, and internal tool endpoints you explicitly need. Wildcard CDN rules are how allowlists rot. Prefer exact hosts and documented reasons in the same ticket that added the tool.
If you already drafted broader guidance, tighten it with sandbox egress allowlists for agents as the operational checklist your on-call can actually follow at 2am.
Keep secrets out of the reachable blast radius
Even with allowlists, do not place long-lived keys in the agent context. Inject secrets through short-lived sidecars or allowlisted secret tools. Follow keep agent secrets out of live session context packs and rotate keys on a schedule with rotate API keys in agent sandboxes.
Error messages should not echo tokens. Sanitize tool failures before they re-enter the model, or your traces become a second secret store you never meant to build.
Bound what tools may request
Schemas should reject arbitrary URLs unless the tool is explicitly a fetcher with host checks. Bound schemas reduce accidental exfil paths. See bound tool schemas before agents call them and keep fetchers on the shortest allowlist you can defend.
Cap result sizes so a compromised endpoint cannot flood context and coerce another call. Use cap tool results before the next turn so poisoned content has less room to steer the next step.
Log denials as first-class events
Every blocked host should emit a structured event with session id and tool name. Patterns in denials reveal prompt injection and bad tool design early. Wire this into the same trace pipeline as structured agent traces so security and product debug share one timeline.
Alert on sudden spikes in novel host attempts. Novelty is often the story, and silence is how allowlist gaps stay invisible for months.
Review allowlists when tools change
A new integration is a new egress review. Remove hosts when features die. Stale allow entries are silent risk. Put the review on the same checklist as schema changes and key rotation so nobody ships a tool with yesterday’s network trust.
Isolation is not hostility to agents. It is how you keep shipping them inside real companies with real auditors and real customers who expect boring reliability.
FAQ
What is sandbox egress isolation?
Restricting outbound network calls from agent runtimes to an explicit allowlist of hosts.
Why not allow the whole web?
Model-chosen URLs and poisoned content can exfiltrate data or pull executable payloads into the loop.
Where do secrets live?
Outside prompt context, in short-lived injectors or allowlisted secret tools with rotation.
Should denials be visible to the model?
Return a safe error class. Do not return raw blocked URLs if that feeds another attack loop.
How often should allowlists be reviewed?
On every new tool integration and on a monthly prune of unused hosts.
Does this replace auth on tools?
No. Egress limits blast radius. Auth and schemas still gate what each tool can do.