What egress control strategies prevent AI agents from reaching malicious destinations?

Five, in order of importance: deny all outbound traffic by default; allow a short list of named domains through a proxy that checks the TLS SNI or Host header rather than trusting DNS alone; block private, link-local and cloud-metadata addresses so the agent cannot pivot inside your network; give each agent its own identity and allowlist on the proxy; and log every allowed and denied connection somewhere the agent cannot write. As of October 26, 2026, Anthropic's sandbox-runtime, Stripe's Smokescreen, OpenSandbox's egress sidecar and E2B's per-sandbox firewall implement these controls.

Is DNS filtering enough to control AI agent egress?

No. A process that connects straight to an IP address never makes a DNS query, so a DNS-only filter cannot see it. OpenSandbox's documentation makes the same point: its Credential Vault refuses to activate in DNS-only mode and requires dns+nft enforcement, because direct-IP connections can bypass DNS policy. Enforce at the packet or proxy layer and use DNS only as a signal.

What is the best egress control tool for a local coding agent?

Anthropic's sandbox-runtime (srt). It wraps any process — a coding agent, an MCP server, a shell command — in OS-level sandboxing (sandbox-exec on macOS, bubblewrap on Linux, a dedicated user and Windows Filtering Platform fence on Windows) with a proxy-based domain allowlist, and needs no container. It is a beta research preview.

How do I stop an AI agent from exfiltrating data through an allowed domain?

Keep the allowlist narrow and path-aware. Allowing all of github.com lets an injected agent push your code to an attacker's repository; allowing only the API paths your task needs does not. Route credentials through a broker with method and path rules, make general web reading go through a separate read-only fetch tool, and alert on unusual upload volume.

Quick Answer

Egress Control for AI Agents: Stop Malicious Destinations

Published: October 26, 2026

The short answer

An AI agent that can reach any host can send your data to any host. Prompt injection makes that a when, not an if. The egress control strategies that actually prevent agents from reaching malicious destinations, as of October 26, 2026:

Deny by default. No outbound traffic unless a rule allows it.
Allow named domains through a proxy that inspects SNI or the Host header — not DNS alone.
Block private, link-local and metadata addresses (for example 169.254.169.254) so the agent cannot scan or pivot inside your network.
One identity and one allowlist per agent, enforced on the proxy.
Log allowed and denied connections to storage the agent cannot touch.

The tool that enforces them depends on where the agent runs. Our step-by-step guide to locking down agent egress covers the rollout; this page compares the tools.

The tools compared

Tool	Where it runs	How it enforces	Price	Best for
Anthropic sandbox-runtime (srt)	Your laptop or server, no container	OS sandbox (macOS sandbox-exec, Linux bubblewrap, Windows WFP fence) + proxy domain allowlist; also filesystem rules	Free, open source (beta research preview)	Local coding agents, MCP servers
Stripe Smokescreen	A proxy you deploy	HTTP CONNECT proxy; hostname ACLs; refuses internal IPs; identifies clients by mTLS certificate for per-client ACLs	Free, open source	Fleets of agents in your own infrastructure
OpenSandbox egress sidecar	Docker or Kubernetes	Per-sandbox egress policy, `dns+nft` enforcement, deny-by-default; optional Credential Vault	Free (Apache 2.0)	Self-hosted agent sandboxes
E2B	Managed cloud (or its open runtime)	One Firecracker microVM per sandbox with an nftables egress firewall and SNI/Host-inspecting domain allow and deny lists	Hobby $0 with $100 one-time credit; Pro $150/month + usage	Hosted sandboxes for agent products

Prices and features from each project’s documentation and pricing page on October 26, 2026.

Anthropic sandbox-runtime — best for local agents

srt was built for Claude Code and released as an open-source research preview. You run srt "<command>" and the whole process tree gets the restrictions: outbound HTTP and HTTPS only to allowed domains, reads and writes only where you permit, Unix sockets controlled. Its README shows the canonical demo — curl anthropic.com succeeds, curl example.com is “blocked by network allowlist”, cat ~/.ssh/id_rsa fails with “Operation not permitted”. It is the quickest way to sandbox a local MCP server: replace the command in .mcp.json with srt and pass the original command as arguments. Because APIs may still change, pin a version.

Stripe Smokescreen — best central proxy

Smokescreen is the proxy Stripe uses for most of its own outbound traffic. Two properties make it a good agent egress gateway: it only connects to allow-listed hostnames, and it resolves each name and refuses non-public IP addresses, which stops an agent from being used to scan your internal network. Clients authenticate with mTLS, and Smokescreen checks each client’s requested destination against its own ACL — that is your one-allowlist-per-agent control. Centralising egress also gives you stable outbound IPs for partners to allowlist.

OpenSandbox — best self-hosted sandbox platform

OpenSandbox (Alibaba, donated to the Agentic AI Foundation on October 22, 2026) attaches an egress sidecar to every sandbox. The docs are explicit about two pitfalls: use defaultAction="deny" and allow every host you need, and run the sidecar in dns+nft mode, because DNS-only filtering can be bypassed by connecting to an IP directly. Its Credential Vault then injects real credentials into allowed requests while the sandbox only holds fakes — egress control and credential brokering in one place.

E2B — best managed option

If you would rather not run infrastructure, E2B gives every sandbox its own Firecracker microVM, cgroup and network namespace, with a per-sandbox nftables egress firewall and SNI/Host-inspecting allow and deny lists. Sandboxes bill per second (about $0.000014 per vCPU-second and $0.0000045 per GiB-second of RAM); Hobby is free with a one-time $100 credit and 20 concurrent sandboxes, Pro is $150 a month for 100 concurrent sandboxes and 24-hour sessions.

The mistakes that defeat egress control

Allowing whole platforms. github.com, *.googleusercontent.com or a pastebin let an injected agent upload data to an account the attacker controls. Allow API paths, not platforms, where the proxy supports it.
Trusting DNS. See OpenSandbox’s warning above; enforce at the packet or proxy layer.
Forgetting the metadata endpoint. A cloud agent that can reach the instance metadata service can often fetch the instance’s credentials.
Logging where the agent can write. An agent that can edit its own logs can hide what it did.
Handing the agent the secret. Egress control limits where data goes; a broker limits what the agent can steal. Use both — see best tools for brokering secrets to AI agents at runtime.

How to choose

A coding agent on your machine: sandbox-runtime.
Many agents in your VPC or cluster: Smokescreen as the single egress gateway, with mTLS per agent.
You run agent sandboxes on Kubernetes: OpenSandbox with dns+nft and Credential Vault.
You are building an agent product and want sandboxes as a service: E2B; compare others in best AI agent sandboxes.

Last verified: October 26, 2026.