AI agent sandbox egress:
ACL, tool registry, and kill switch before open internet

Why sandbox demos still reach open internet

Lab agents look contained because the UI says "sandbox" and the notebook sits on an isolated VPC. That label is not a control. The first time a tool can open a socket, fetch a URL, or call an MCP server with outbound rights, the agent has a path to the public network. Demos hide that path behind happy-path prompts. Production incidents surface it as wiki edits, webhook spam, credential probes, or quiet data exfil through "harmless" HTTP helpers.

Egress failure is usually policy shape, not model cleverness. A permissive proxy that allows anything matching a broad allowlist, a shared egress NAT used by both humans and agents, or a tool that shells out to curl without a destination contract all produce the same outcome: the agent left the lab while dashboards still showed green.

Harness design decides whether that path exists. If tools are free-form and network is ambient, containment is theater. Pair this with multi-agent harness deployment before raising autonomy.

Failure modes when egress is implicit

Ambient network: the runtime inherits cluster DNS and outbound NAT. Any library can dial. The agent never "requested internet"; the process already had it.

Proxy allowlists that match shape, not intent: HTTPS to well-known CDNs, package mirrors, or documentation hosts becomes a tunnel for anything that looks like those hosts. Covert reuse of allowed ports is common when ACL checks stop at protocol and port.

Unregistered network tools: HTTP Request nodes, browser tools, MCP fetch servers, and code interpreters appear as first-class agent tools with no destination scope. The planner treats them as capabilities; security treats them as afterthoughts.

No kill path: when fan-out starts, operators kill one container and leave siblings, queues, and scheduled retries alive. The swarm continues under new process IDs.

Unreconstructable runs: chat transcripts show polite text. Missing pieces are which tool opened which socket, under which principal, with which args. Without a durable run ID on every egress attempt, the postmortem is IP correlation and guesswork. See agent observability.

Shadow and lab sharing production egress: staging agents reuse the same outbound path as customer workloads. A lab experiment becomes a production network event without a separate blast radius.

Egress ACL and tool registry that hold

Define egress at two layers that must agree. Layer one is the runtime network policy: deny by default, allow only named destinations (host, port, protocol) per environment. Layer two is the tool registry: every network-capable tool declares destination scope, auth class, side-effect class, and whether the call is reversible. A tool call that would leave the allowlist is a policy deny, not a model retry.

Bind registry entries to schema versions. When someone adds a new HTTP helper or widens a URL parameter, treat it as a control-plane change, not a prompt tweak. Policy-as-code fits here: encode allowlists and tool contracts so reviews see diffs, not tribal knowledge (policy as code for agents).

Carry principal and run ID on every egress attempt. The gateway or harness should reject tools that cannot stamp those fields. Align with the same identity story used for LLM, MCP, and A2A gates in the triple-gate pattern so network policy and agent policy share one run identity.

Operable minimum for a network tool: tool ID, schema version, allowed hosts or host patterns, auth class, side-effect class, and outcome codes for allow, deny, and transport error. Without those, "we have a sandbox" is a label on a laptop.

Kill switch and run ID reconstruction

A kill switch is an operator action that terminates the run tree by durable run ID: planner, child workers, queued tool jobs, and open sockets. It must be discoverable in the run inspector without paging the author. Log who triggered it, why, and which children stopped. Pair auto-triggers with hard denials: repeated ACL denies to sensitive destinations, loop detection on identical egress args, or fan-out above budget should propose or execute halt according to policy.

Reconstruction requires the same ID on plan steps, model calls, tool spans, ACL decisions, and kill events. After an open-internet incident, operators should answer in minutes: which tool left the lab, which destination, which principal, whether the ACL should have denied it, and whether kill fired. Chat logs alone cannot answer those questions. Incomplete span trees are a first-class defect; treat missing egress spans like missing payment logs.

Feed denied and escaped attempts into weekly eval cases. If a tool path reached a host outside scope, promote that arg pattern into CI so the next registry change cannot reopen it silently.

Rollout sequence that shrinks blast radius

Start with one high-risk workflow that already has network tools. Put it behind deny-by-default egress and a registry with explicit destinations. Prove you can deny a bad URL, allow a named API, and reconstruct both outcomes from the run inspector alone.

Split lab egress from production egress. Shadow or draft modes may observe real prompts, but their network allowlist should stay narrower than production write paths. Expand destinations only when traces show complete trees and operators have rehearsed kill.

Measure ACL deny rate, percentage of network tool calls with full spans, time-to-kill after alert, time-to-reconstruct a bad run, and count of destinations added per week without registry review. Rising ambient allow traffic without matching registry entries is a control regression, not growth.

Document break-glass: who may widen egress, for how long, and how the temporary allow appears in audit. Sandbox escape stories repeat when temporary holes become permanent defaults. Harden the registry and the kill path before you raise autonomy, not after the first public side effect.