# Agent egress allowlist too permissive

Allowlisted domains or auto-approved commands that an attacker can control, read, or use to carry data out

_Area: AI and LLM app security. Seen in 4 disclosed reports; latest 2026-07-16. Updated 2026-10-23._

## How it works
An agent sandbox limits outbound traffic to an allowlist, assuming every listed destination is safe. That assumption breaks in two distinct ways. First, *control*: an allowlisted destination may be one an attacker can host content on or register a subdomain under, so the agent talks to the attacker. Second, *observability*: an allowlisted destination may accept attacker-supplied credentials or expose request logs the attacker can read, so data sent there lands in attacker hands even though the endpoint is legitimate. The allowlist constrains *where* traffic goes, not *who* receives it. A related failure is rendering: output that reaches a terminal or renderer can trigger outbound lookups without any tool call [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-macos-terminal-dillma-dns-exfil-ansi-escape-code-fix.md).

## Where it shows up
- Default egress allowlists that include first-party/vendor API domains accepting credentials [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-claude-abusing-network-access-and-anthropic-api-for-data-exfiltration.md).
- Whole parent domains trusted where anyone can register a subdomain (cloud providers, PaaS, CDNs, dynamic DNS) [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-codex-remote-control-zombai.md).
- Tool commands classified read-only or auto-approved that can carry data out-of-band (ping, dig, nslookup, curl) [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-data-exfil-via-dns.md).
- LLM output passed with raw control characters to a terminal or renderer that acts on escape sequences [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-macos-terminal-dillma-dns-exfil-ansi-escape-code-fix.md).
- Untrusted input reaching the agent: code comments, tool output, GitHub issues [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-data-exfil-via-dns.md)[E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-codex-remote-control-zombai.md).

## How to review
For each allowlisted destination, ask: can an outside party control content or a subdomain there, supply their own credentials, or read the request logs? If yes, it is an exfil channel. Scope this to credential-accepting endpoints rather than treating all vendor domains as unsafe. For tool allowlists, enumerate every command that runs without confirmation and check whether it can transmit data. Check whether the allowlist is a default or opt-in. The invariant: no allowlisted destination may be both reachable by the agent and controllable or observable by an attacker, and untrusted content must not be able to steer the agent toward such destinations.

## Variants seen
- First-party API domain in a default package-manager allowlist used to upload files to an attacker's account [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-claude-abusing-network-access-and-anthropic-api-for-data-exfiltration.md).
- Read-only-classified commands (ping, dig) leaking secrets via DNS without confirmation [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-data-exfil-via-dns.md).
- Wildcard-trusted cloud parent domain (azure.com) turning an attacker VM into command-and-control [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-codex-remote-control-zombai.md).
- Terminal escape sequences in LLM output triggering DNS lookups for exfiltration [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-macos-terminal-dillma-dns-exfil-ansi-escape-code-fix.md).

## Impact and severity
High: user files, secrets and data left the sandbox to attacker-controlled storage or logs [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-claude-abusing-network-access-and-anthropic-api-for-data-exfiltration.md)[E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-data-exfil-via-dns.md), agents became remotely controlled nodes [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-codex-remote-control-zombai.md), and rendered output leaked data without any tool call [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-macos-terminal-dillma-dns-exfil-ansi-escape-code-fix.md). Severity rises when the channel needs no user consent (auto-approved commands) [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-data-exfil-via-dns.md) and when the allowlist is a default rather than opt-in [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-claude-abusing-network-access-and-anthropic-api-for-data-exfiltration.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-macos-terminal-dillma-dns-exfil-ansi-escape-code-fix.md
- E2: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-claude-abusing-network-access-and-anthropic-api-for-data-exfiltration.md
- E3: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-data-exfil-via-dns.md
- E4: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-codex-remote-control-zombai.md