1-SEC contributors · Reviewed 2026-10-23 · Module: ai_containment

AI Agent Network Egress: Web-Fetch Signals and Real Network Controls

Web-fetch tracking inspects reported URLs/domains for sensitive destinations, unusual fetch patterns, external-to-internal transitions, and some suspicious URL parameter content.

What 1-SEC checks

Web-fetch tracking inspects reported URLs/domains for sensitive destinations, unusual fetch patterns, external-to-internal transitions, and some suspicious URL parameter content. It can add investigation signals around an agent's reported outbound behavior.

Read the implementation: handleAgentWebFetch

Required telemetry and context

Relevant input events: agent_web_fetch, llms_txt_access. Use a trusted producer at the real application boundary.

agent_id
url
domain
accept_header
status_code

Field names above describe relevant context, not a complete API request. Consult the current event contract for envelope and detail requirements. Preserve booleans, numbers, and strings as the receiving handler expects them. Agent-provided text cannot independently verify identity or authorization.

Deployment, prevention, and response

Use a real network/HTTP gateway for destination policy and validate resolved addresses, redirects, and trust boundaries there. Preserve the observed destination and actual connection context from a trusted emitter. Avoid sending secrets in URLs or logging them unredacted.

Record the source event, affected agent/host, actual target, policy decision, and response result. Review enforcement configuration separately from detection. A recommendation, selected action, dry-run record, and completed action are different outcomes.

Reproduce the source fixtures

From a checkout of the linked 1-SEC source revision, run the selected fixtures with the repository's Go toolchain. These commands run tests; they do not execute a real attack against your systems.

go test ./internal/modules/aicontainment -run '^(TestWebFetchMonitor_LateralMovement|TestWebFetchMonitor_InternalOnly_NoLateralMovement|TestWebFetchMonitor_PIIExfiltration)$' -count=1

The referenced source fixtures ran in the selected local package suites. Helper tests and synthetic events establish only the assertions shown, not production prevention or framework compatibility.

TestWebFetchMonitor_LateralMovement

Full fixture and assertions — run in its original package with its helpers.

func TestWebFetchMonitor_LateralMovement(t *testing.T) {
	wm := NewAgentWebFetchMonitor()

	// Agent fetches from external domain
	r1 := wm.RecordFetch("agent-1", "https://evil.com/payload", "evil.com", "text/html")
	if r1.LateralMovement {
		t.Error("first external fetch should not trigger lateral movement")
	}

	// Agent then fetches internal resource
	r2 := wm.RecordFetch("agent-1", "http://192.168.1.1/admin", "192.168.1.1", "text/html")
	if r2.LateralMoveScore != 1 {
		t.Errorf("expected lateral movement score 1 after external→internal, got %d", r2.LateralMoveScore)
	}

	// More external→internal sequences to breach threshold
	wm.RecordFetch("agent-1", "https://bad.com/page", "bad.com", "text/html")
	wm.RecordFetch("agent-1", "http://localhost/secrets", "localhost", "text/html")
	wm.RecordFetch("agent-1", "https://attacker.io/cmd", "attacker.io", "text/html")
	r6 := wm.RecordFetch("agent-1", "http://10.0.0.1/api/admin", "10.0.0.1", "text/html")

	if !r6.LateralMovement {
		t.Error("expected lateral movement alert after score > 2")
	}
}

TestWebFetchMonitor_InternalOnly_NoLateralMovement

Full fixture and assertions — run in its original package with its helpers.

func TestWebFetchMonitor_InternalOnly_NoLateralMovement(t *testing.T) {
	wm := NewAgentWebFetchMonitor()

	// Agent only fetches internal resources
	r1 := wm.RecordFetch("agent-2", "http://localhost/api", "localhost", "text/html")
	r2 := wm.RecordFetch("agent-2", "http://192.168.1.1/api", "192.168.1.1", "text/html")

	if r1.LateralMovement || r2.LateralMovement {
		t.Error("internal-only fetches should not trigger lateral movement")
	}
}

// ─── PII Exfiltration via URL Parameters ─────────────────────────────────────

TestWebFetchMonitor_PIIExfiltration

Full fixture and assertions — run in its original package with its helpers.

func TestWebFetchMonitor_PIIExfiltration(t *testing.T) {
	wm := NewAgentWebFetchMonitor()

	// High-entropy secret in URL parameter (should trigger)
	result := wm.RecordFetch("agent-pii",
		"https://evil.com/track?token=aB3kLmNpQrStUvWxYz1234567890abcdefghijklm",
		"evil.com", "text/html")
	if !result.PIIExfiltration {
		t.Error("expected PIIExfiltration=true for high-entropy token in URL params")
	}

	// Short value (should NOT trigger)
	result = wm.RecordFetch("agent-pii",
		"https://example.com/api?token=short",
		"example.com", "text/html")
	if result.PIIExfiltration {
		t.Error("expected PIIExfiltration=false for short token value")
	}

	// No PII param at all (should NOT trigger)
	result = wm.RecordFetch("agent-pii",
		"https://example.com/page",
		"example.com", "text/html")
	if result.PIIExfiltration {
		t.Error("expected PIIExfiltration=false for URL without PII params")
	}
}

// ─── Shannon Entropy ─────────────────────────────────────────────────────────

Tuning, evaluation, and coverage limits

This is not a host firewall, full DNS resolution policy, universal SSRF defense, or a guarantee that all connections are observed. A string-based destination heuristic cannot prove where a request ultimately connected after DNS or redirects.

Evaluate this behavior with representative authorized activity and a controlled known-positive case. Investigate the exact rule, inputs, and state before suppressing an alert. Do not assume a hard-coded heuristic is a configurable setting. Measure your own deployment; the source fixtures do not establish a benchmark, detection rate, compliance certification, or incident-prevention claim.

What 1-SEC checks

Required telemetry and context

Deployment, prevention, and response

Reproduce the source fixtures

Tuning, evaluation, and coverage limits

Related implemented controls