LLMs, GenAI, RAG, agents, evaluation · insight-1574

Give a sandboxed agent a domain allow-list for egress instead of all-or-nothing network access

Situation
A coding agent in a sandbox needs to install packages, but the team has either cut the network entirely or opened it fully.
Action
Route outbound traffic through a proxy outside the sandbox that permits only named domains, such as the package index, logs denied requests, and requires an explicit decision to add a new domain, alongside filesystem limits.
Reason
Anthropic describes needing both filesystem and network isolation, with a proxy that restricts reachable domains and asks for confirmation of new ones.
Boundary
Agents that execute code or commands and need limited network access.

Symptom or risk

With no network the agent cannot work, and with a full network a manipulated agent can send out files or secrets.

Fully offline tasks should keep the network closed.

Allow-lists need upkeep, and allowed domains can still host attacker-controlled content.

Allowing broad domains, such as a general file host, that can receive uploads.

Anthropic states that both filesystem and network isolation are needed, and describes a proxy outside the sandbox that restricts which domains a process can reach and asks the user to confirm new domains.
Beyond permission prompts: making Claude Code more secure and autonomous