Egress is the cheapest leg of the lethal trifecta to cut, but only if every channel is enumerated first: a sandbox that blocks curl and leaves the agent’s own rendered output alone has closed one door in a room with three.

The mechanism

MATRA’s study of OpenClaw is the clearest demonstration, because the sandbox worked exactly as designed and the data still left. The agent ran in a Docker container with network=none, which closed every exec-based path. Two channels were never inside the container. The messaging tool ran on the gateway host, outside the sandbox entirely. And the agent’s own response could embed queried data in a markdown image URL that the client then auto-fetched, with no user click and no network call by the agent at all. The paper’s conclusion is the one to internalise: no single architectural control is sufficient when multiple exfiltration channels exist.

So the unit of work is not “block the internet.” It is enumerating the channel classes an agent actually has, then putting a control on each: outbound tool calls, messaging and mail tools, and whatever renders the agent’s output. Skipping the enumeration buys confidence rather than containment.

Denylists fail for a documented reason. When researchers tested seven MCP clients against remote-script execution in November 2025, Cursor and Cline both executed the script but rejected URLs containing attacker.com, string-matching the demo domain and defeated by renaming the host. More telling: the four clients that did block worked through model-level refusal rather than any network control, which the authors call the most critical gap. A defense that depends on the model declining is at the mercy of the next prompt.

Put the control in the network rather than the agent’s instructions, for the reason OpenAI’s own governance paper gives: hard-coded action restrictions stop working once an agent can involve another party. The agent sends an email, which is allowed, to a human who then takes the disallowed action. Their prescribed remedy is network controls limiting interaction with the outside world except through monitored channels.

What to do

The cheap version, in order:

1. Enumerate the channels for each agent. Outbound HTTP, every tool that can send something to a person, and the surface that renders responses. This list is the control’s scope; without it the rest is guesswork.
2. Default-deny with a short allowlist. OWASP’s KC6.1 is the citable form: route external requests through an outward proxy or API gateway that permits only pre-approved destinations, with permitted base URLs or URL patterns validated before each request, plus network policies for containerised agents.
3. Sanitise output. Strip or rewrite URLs carrying encoded data before responses reach a messaging channel, and turn off automatic image fetching wherever agent output is displayed. This is the counter to the zero-click path above and it costs almost nothing.
4. Allowlist recipients for anything that can send mail. In MATRA’s scenario the recipient allowlist plus output sanitisation together closed the residual paths that sandboxing had left open.

The thorough version adds what OWASP’s KC6.4 specifies for web-using agents: DNS-based filtering underneath the HTTP-level filtering, TLS verification, blocking open redirects and long redirect chains, network segmentation so a coerced request cannot reach internal systems, rate-limiting web access, and restricting downloadable file types. Sandbox the browser component rather than driving the user’s own browser.

On low-code platforms the connector policy is the egress control. Power Platform’s advanced connector policies reached general availability on 2026-06-04 and allow or block individual actions inside a connector, with defaultConnectorActionRuleBehavior settable to Block, genuine default-deny at action granularity. The GA release extends it to govern MCP servers as policy objects. Connector policy governs destinations while Purview DLP governs data handling; neither replaces the other.

How you’d know it’s working

Run a canary per channel class, on a schedule. Plant a marked string in data the agent can reach, instruct it to exfiltrate through each enumerated channel in turn, and require a denial recorded in the egress or gateway log for every one. MATRA documents precisely the failure a narrower test misses: a test that only exercises outbound HTTP will pass while the markdown path stays open.

Blocked-egress events should be non-zero in steady state. Zero means either the allowlist is wide enough to be decorative or nobody is testing it.

Borrow MATRA’s method rather than its numbers. Its Very High to Moderate reduction is the output of a semi-quantitative threat model with author-assigned ratings on scales the paper itself calls deliberately coarse. The transferable part is the practice of scoring each channel separately before and after a control, not the figure.

What this doesn’t solve

Allowlisted destinations remain destinations. An agent permitted to reach the firm’s CRM can write anything to that CRM, and an approved mail domain is a fine staging point for a human to collect later.

Destination-based control degrades badly against platform-hosted applications. A firewall sees the vibe-coding platform’s primary domain, not the thousands of distinct applications on its subdomains, each with its own owner and exposure. Worse, those applications inherit the platform’s reputation, so filtering by domain reputation performs poorly by construction. This is architectural reasoning documented at scale by a vendor that sells the remedy; the underlying fact is independently checkable.

Two conflations to avoid. Running connectors inside a virtual network gives private-endpoint reachability, so internal resources stay off the public internet. That is useful, and it is a different control from an outbound allowlist. Action-level connector control only applies to blockable connectors: Microsoft documents that it cannot be configured for unblockable or custom connectors, and that apps published before 2020-10-01 need republishing for rules to bite. An allowlist with an unblockable tail is not default-deny, and the gap is exactly where a determined maker will go.

Auditors will map agent egress to ISO/IEC 27001:2022 Annex A 8.12, 8.22 and 8.23: data leakage prevention, network segregation, web filtering. Be ready for the gap: the standard’s text contains zero occurrences of “artificial intelligence” or “machine learning”. Those controls were written for people browsing and mailing, and token-level exfiltration inside a model’s response or an MCP tool call is outside what they contemplate; ISO/IEC 42001 exists to fill that gap.

Nothing here addresses agent-to-agent traffic inside the perimeter, or an agent misusing data it is entitled to hold. The tidy version, a dedicated, separately-killable “agent channel” that can be suspended without suspending people, remains a research proposal: Chan et al. describe it and say plainly that no such infrastructure exists. Routing agent egress through a single gateway that can be turned off approximates it locally, and that inference is ours rather than theirs.

See also

• Data exfiltration — the concern this control answers.
• Prompt injection and goal hijack — why injection becomes survivable once the exfil channel is already cut.
• The lethal trifecta — why cutting one leg beats filtering all three.
• Sandboxing and isolation — the execution-side counterpart, and what it demonstrably leaves open.
• Data access governance — cutting the other leg when outbound reach is load-bearing.
• AI gateways — the product category that sells this enforcement point.