Deterministic Egress Containment

Deterministically restricting an agent's outbound network channel at the infra/network boundary — domain-aware, default-deny, per-workload — so a prompt injection cannot reach an arbitrary destination; the remedy that lethal-trifecta only diagnoses.

Also known as: deterministic egress containment, domain-aware default-deny egress, FQDN egress policy, SNI-based egress, per-pod egress identity, cut the exfiltration leg, egress control

Part of: Lethal Trifecta

How authors use it

Oldest first (extraction date when no publication date is known).

Documents (7)

• Article: Securing MCP in Production: Defense-in-Depth Beyond the Gateway Nik Kale · 2026-07-29 source ↗ Reader 🖥️
  Production MCP deployments need enforcement distributed across four distinct architectural layers — safe tool execution, an isolated management plane, a bounded outbound trust boundary, and pinned/monitored semantic integrity — each with its own earliest trustworthy enforcement point, because an API gateway can authenticate and authorize traffic but cannot safely execute tool logic, isolate management-plane infrastructure, contain a server's own outbound calls, or detect that a previously-trusted tool definition has changed.
• How building software is changing at Anthropic The Pragmatic Engineer · 2026-07-28 Reader 🖥️
  Inside Anthropic, AI has not eliminated the traditional structure of software engineering (planning, PRDs, cross-team alignment, code review) so much as relocated where the effort and the bottleneck sit — from writing code to verifying it, and from one engineer working alone to fleets of parallel AI agents whose output is checked, merged, and increasingly re-reviewed by other AI, while every design assumption must now be re-tested at each new model generation.
• Presentation: From Copy-Paste to Composition: Building Agents Like Real Software Jake Mannix · 2026-07-27 source ↗ Reader 🖥️
  LLM-based agents that wire raw MCP tool descriptions verbatim into an agent's context window are architecturally equivalent to unstructured 1975 BASIC — one big file, no interfaces, no encapsulation — and the fix, without rewriting MCP itself, is a lightweight 'virtual tools' layer interposed between agent and tool server that gives agent teams real interfaces, encapsulation, composition, versioning, and deterministic taint-tracking security, all stored in a shared registry alongside the evals that define what each agent is for.
• Anthropic Details How It Contains Claude Across Web, Code, and Cowork Eran Stiller · 2026-07-22 source ↗ Reader 🖥️
  Anthropic argues, and illustrates through three product-specific incident/fix pairs (Claude Code's pre-trust-decision config parsing, a red-team credential-exfiltration test, and Cowork's Files-API allowlist bypass), that agent safety must rest on deterministic environmental boundaries — sandboxed execution, default-deny networking, and function-scoped egress — because model-level controls and human approval prompts can influence but never guarantee an agent's behavior.
• GKE Security Blueprint Joins Growing List of Cloud AI Frameworks Matt Saunders · 2026-07-22 source ↗ Reader 🖥️
  As AI workloads move from prototype to production on managed Kubernetes, Google, AWS and Microsoft are each publishing layered security blueprints that harden a different part of the stack (infrastructure, identity/observability, and agent identity respectively), but none of these approaches is sufficient alone because neither cloud-native perimeter/identity controls nor Kubernetes itself can reason about semantic, runtime properties of AI behavior — whether a prompt is malicious, a response leaks data, or a permitted action is actually normal for a given agent.
• Prompt Injection to Data Exfil in 3 Hops Nick Davitashvili · 2026-07-10 Reader 🖥️
  Prompt-injection-driven data exfiltration from Kubernetes-hosted AI agents cannot be stopped by probabilistic model-layer guardrails or by L3/L4 Kubernetes NetworkPolicy, and the reliable fix is deterministic, domain-aware, default-deny network egress containment that removes the lethal trifecta's channel leg — contained rather than eliminated, and paired with application-layer controls.
• GitLost: How We Tricked GitHub's AI Agent into Leaking Private Repos Sasi Levi · 2026-07-06 Reader 🖥️
  GitLost demonstrates that GitHub's Agentic Workflows can be tricked by an unauthenticated, unprivileged attacker into leaking private-repository contents through indirect prompt injection — hiding instructions in a public GitHub Issue that a cross-repo-privileged agent reads as trusted input and acts on — because the system fails to maintain a code-enforced trust boundary between untrusted user data and system-level directives, a structural weakness Noma frames as endemic to agentic AI rather than specific to this one GitHub feature.

Propositions touching this concept (1)

By publication month, oldest first (extraction month when no publication date is known).

2026-07

• explicitcontestedProduction MCP deployments need outbound egress control (allow-lists) and scoped, tool-specific credentials in parallel, because inbound authentication alone did not stop the Azure MCP Server SSRF (CVE-2026-26118) from leaking managed-identity tokens.
  Article: Securing MCP in Production: Defense-in-Depth Beyond the Gateway · p4

Open gaps (8)

• incompleteHaving established that 'an allowlisted domain grants access to every function reachable through it,' the article stops at the single Files-API fix and does not say whether Anthropic audited its other allowlisted domains (or other products) for the same class of function-level exposure, or whether the lesson became a general policy.
  Anthropic Details How It Contains Claude Across Web, Code, and Cowork — read next: Look for a broader Anthropic security-architecture review or policy statement extending the session-token-proxy pattern beyond Cowork.
• incompleteThe talk explicitly flags but does not resolve what happens to an agent's in-flight plan when the runtime taint-tracking layer removes tools mid-session: the speaker acknowledges the agent 'is going to think... I'm going to do this thing first... Then the tools are going to disappear. Then you're like, I'm going to do something different now. I don't know what I'm going to do,' and concedes 'it's not perfect' — but offers no mechanism for graceful replanning, partial-completion handling, or user-facing explanation when this occurs.
  Presentation: From Copy-Paste to Composition: Building Agents Like Real Software — read next: Read alongside work on agent replanning and mid-task tool-availability changes, and against extract-turing-post-5-patterns-long-running-agents on checkpoint/resume patterns for long-running agents, to see whether any existing pattern handles a shrinking tool surface mid-plan without silent agent confusion.
• incompleteThe article juxtaposes Google's recommendation of Workload Identity Federation and VPC Service Controls as sufficient network/identity-perimeter defenses with ARMO's claim (reported two paragraphs later, about AWS) that identity and perimeter tools 'stop at the workload boundary' precisely where agentic threats happen — but never asks whether Google's own perimeter controls are subject to the same critique.
  GKE Security Blueprint Joins Growing List of Cloud AI Frameworks — read next: Read alongside extract-prompt-injection-to-data-exfil-in-3-hops, which argues in detail that Kubernetes NetworkPolicy (L3/L4) cannot see semantic/application-layer attacks and that only per-pod, domain-aware deterministic egress containment closes the gap — VPC Service Controls is a GCP-API perimeter, not a workload egress filter, so the same structural critique likely applies to it and is left unexamined here.
• incompleteThe Layer 3 NetworkPolicy code example enforces CIDR-block egress at L3/L4, but the article never engages that CIDR-based network policies cannot distinguish domains behind a shared or rotating CDN IP, cannot inspect TLS SNI, and leave DNS-based exfiltration channels entirely open even when correctly configured — precisely the class of bypass a more rigorous corpus treatment of Kubernetes egress containment demonstrates defeats CIDR allowlists.
  Article: Securing MCP in Production: Defense-in-Depth Beyond the Gateway — read next: extract-prompt-injection-to-data-exfil-in-3-hops, which argues for deterministic, domain-aware, SNI-based default-deny egress specifically because L3/L4 NetworkPolicy cannot see this attack class.
• incompleteThe diff classifier that separates 'cosmetic' from 'material' manifest changes is presented as the solution to alert fatigue and rubber-stamping, but its own false-negative rate — a material, malicious redefinition misclassified as cosmetic and auto-approved without ever reaching human review — is never examined, even though this is exactly the failure mode that would silently defeat manifest pinning's central promise.
  Article: Securing MCP in Production: Defense-in-Depth Beyond the Gateway — read next: Literature on classifier-gated security controls and their own adversarial robustness; compare against the structurally identical anomaly-gating false-negative problem already flagged elsewhere in this corpus for a pre-filter in front of an LLM-driven SOC pipeline.
• uninformedThe headline vulnerability statistics (Adversa AI: 38% of scanned servers had no authentication on critical endpoints, 43% were vulnerable to command execution) are cited without any account of sampling methodology — which registries were scanned, whether internet-exposed servers were selectively discoverable (a bias toward the least secure population), or how 'critical endpoint' was defined.
  Article: Securing MCP in Production: Defense-in-Depth Beyond the Gateway — read next: Adversa AI's underlying report methodology; cross-check against the independently-sourced 43%-auth-flaw / 33%-unrestricted-network-access figures already in extract-mcp-api-sprawl#p4 for consistency or divergence in sampling.
• incompleteThe four-week rollout sequences layers by ease-of-verification but never addresses interaction effects during the rollout window itself — e.g., whether leaving Layer 4 (manifest pinning) unpinned through weeks 1-3 lets an attacker redefine a tool to bypass the newly-hardened Layer 1 and Layer 3 controls before pinning goes live in week 4, which would undermine the staggered approach's safety during its own transition period.
  Article: Securing MCP in Production: Defense-in-Depth Beyond the Gateway — read next: No pointer given by the author; would need practitioner accounts of partial-rollout security posture or a formal ordering/interaction analysis across the four layers.
• uninformedThe reporting draws entirely on four named individuals inside Anthropic (a platform-org engineering head, one high-profile external contractor turned employee, one cross-functional engineer, one applied-AI/sales-engineering role) with no comparison to Anthropic teams operating under tighter constraints, no former-employee or outside-critical perspective, and no acknowledgment that access journalism inside the very lab that sells the tools being praised may select for best-case, showcase-ready stories.
  How building software is changing at Anthropic — read next: Look for outside-in or critical accounts of Anthropic engineering culture (former-employee retrospectives, competitor comparisons, or the promised follow-up piece comparing Anthropic and OpenAI) to check whether practices like the 11-day Bun rewrite are typical internally or a cherry-picked outlier.