Agent Egress Security, Done Right

Containment takes 247 days when the policy lives in ten thousand places. It takes seconds when it lives in one.

It already happened

Two incidents from the past year. Both real, both agent-shaped, both contained the hard way: machine by machine, org by org.

In the Nx case a malicious package turned the AI CLIs themselves into the thief, launching them with --yolo and --trust-all-tools to hunt credentials and push them to attacker-controlled repos. Cleanup was every machine, by hand. (Wiz, OX Security)

In the Salesloft case the stolen OAuth tokens belonged to a single AI chat agent, and containment still meant disabling every integration and rotating credentials across hundreds of customers. (The Hacker News)

Neither was an outlier. The same IBM study puts the wider picture like this.

The scoreboard

Do this for Claude. And GPT. And Gemini.

Every frontier vendor now ships an egress control. Good. Here is what running them across a fleet actually looks like.

"sandbox": {
  "enabled": true,
  "network": {
    "allowedDomains":
      ["api.anthropic.com"]
  }
}

# ~/.codex/config.toml
[sandbox_workspace_write]
network_access = false

# plus a domain policy map
# in newer builds

export SEATBELT_PROFILE=
  restrictive-proxied
export GEMINI_SANDBOX_PROXY_COMMAND=
  ./your-allowlist-proxy.js

# yes, you write the proxy

Now repeat that. Every laptop. Every CI runner. Every repo. Every agent your agents spawn. Every version bump.

And your homegrown agents? LangChain, CrewAI, that Python script from Q2? No such switch exists. The fastest-growing part of the fleet has none of these controls.

The structural problem

The s1ngularity malware did not defeat these controls. It ran with --yolo.

A control that lives inside the runtime dies with the runtime. On a compromised host the sandbox config sits in the same blast radius as the agent it is meant to restrain.

Put the policy below the runtime and the same compromise changes nothing. The agent is still compromised, --yolo and all. Its undeclared egress just dies on the wire.

The difference is not a better sandbox. It is which side of the compromise the control sits on.

The Solution

Now do it ONE TIME with Maya

Environment="MAYA_AGENT_NAME=invoice-agent" "MAYA_AGENT_LABELS=team=finance"

{team=finance} may only reach {ALL-LLMs} → block

One policy, one tag. It covers the agents running now, next week's agents, and next month's fleet, because none of them have to be named.

Honest math: line 1 is one naming line per agent, or zero with OTEL. Line 2 is one policy sentence per fleet. The policy never multiplies.

Fleets do not get safer one config file at a time. They get governed in one place, or not at all.

Sources: Wiz on the s1ngularity aftermath, OX Security on how s1ngularity weaponized AI, The Hacker News on Salesloft Drift, IBM Cost of a Data Breach 2026, Claude Code sandbox settings, Codex config reference, Gemini CLI sandboxing.

We're taking on customers and a small number of design partners, both running agents in their own cloud. If that's you, we'd like to talk.