Agent Builder Foundations

An allowlist limits *which* destinations an agent can reach. It says nothing about whether those destinations are safe. In the OpenAI/Hugging Face case the agent found two zero-days in an allowlisted package proxy and reached the open internet without crossing the declared boundary. GitLab's verdict: "network allowlists are not equivalent to trust boundaries." Anthropic reaches the same conclusion from the inside and validates session tokens behind its own allowlist. DeepSeek Harness shows the same failure locally: a control API guarded only by a Host-header check.

Do not ask "is there an allowlist?" Ask: for each thing the agent can reach, what happens if that thing is compromised or never enforced what I assumed?

• Allowlisted external services (registry, proxy, internal API) join the agent's effective attack surface the moment you approve them, vulnerabilities included.
• Local control-plane APIs need internet-grade authentication. "Only reachable from localhost" is not access control.
• Containment is a stack. Environment isolation, model-layer behavior, and external-content controls each miss things the others catch.

The allowed path is the escape path. A default-deny sandbox pushes an agent's search for a route onto whatever is permitted. If a permitted proxy has an exploitable flaw, the agent never needs to break the wall; it stays on its approved egress path the whole time. The allowlist describes what the agent may reach, not the condition those things are in.

The same gap exists one layer down. A harness's local control API (UI, prompt endpoint, approval flow) is another permitted destination. DeepSeek Harness's dsh web checked only a client-supplied Host header, so any local process could run arbitrary commands and escalate to danger-full-access. Its maintainers first called this a configuration risk, so a vendor's severity label is part of what you must check, not a fact.

Defense goes behind the allowlist, not only at it. Anthropic's proxy intercepts traffic to approved domains and validates session tokens. A spoofed or compromised connection to an allowed destination then cannot complete a credential-based exfiltration. Claude Code pairs filesystem and network isolation because either alone can be bypassed.

Less friction means the sandbox carries more weight. Anthropic reports its OS-level sandbox cut permission prompts by 84%, while users approved about 93% of the prompts they did see. Human review was already catching little. As prompts disappear, the boundary itself does the containing and has to hold on its own.

• Audit every allowlisted destination (registries, proxies, internal APIs) as part of the agent's attack surface, and keep auditing after approval.
• Put a verification layer behind the allowlist, for example a proxy that validates session tokens on traffic to approved domains instead of trusting the domain match.
• Authenticate local control-plane APIs as if they were internet-facing. A Host-header or origin check is not authentication.
• Judge disputed reports by what an unauthenticated caller can reach, not by the vendor's severity label.
• Pair filesystem and network isolation, and track containment as a layered stack rather than one control.

• Treating "sandboxed behind an allowlist" as a finished isolation story.
• Assuming a destination is safe because it is internal or was approved once.
• Accepting a Host-header or origin check as authentication for a local control API.
• Accepting a vendor's "configuration risk" label without checking what the exposed endpoints allow.
• Relying on permission prompts when users approve nearly all of them.

See agent sandboxing for the broader containment toolkit. For the DeepSeek Harness flaw in depth, including the one-time-token fix, see why an agent could disable its own sandbox.