# Fix: no egress allowlist

Limit which hosts the agent can reach so a hijacked agent cannot send your data out.

Check: egress. Controls: ASI01, MCP10.

An agent that can reach any host can send any secret to any host. An allowlist ends that.

## Detect

List what the agent talks to now:

```bash
# macOS and Linux: established outbound connections
lsof -nP -iTCP -sTCP:ESTABLISHED | awk '{print $1, $9}' | sort -u | head -40
```

## Fix on Linux (container or VM)

Allow DNS, loopback and named hosts. Drop the rest:

```bash
sudo iptables -A OUTPUT -o lo -j ACCEPT
sudo iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
for h in api.anthropic.com api.openai.com api.securemyagent.ai github.com; do
  for ip in $(getent ahostsv4 "$h" | awk '{print $1}' | sort -u); do
    sudo iptables -A OUTPUT -d "$ip" -j ACCEPT
  done
done
sudo iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -P OUTPUT DROP
```

IPs change. Prefer a proxy that filters by hostname.

## Fix with a proxy

Run the agent with `HTTPS_PROXY` set to a proxy that allows only listed hostnames. Block everything else.

## Fix on macOS

Use an application firewall that filters outbound traffic per app, and allow only the hosts the runtime needs.

## Keep a short list

Typical allowlist: your model provider, `api.securemyagent.ai`, your package registry, your git host. Everything else needs approval.

## Verify

```bash
curl -sS -m 5 https://example.com -o /dev/null -w '%{http_code}\n'
```

Expect a failure. Pro: Guard enforces the allowlist per tool call and blocks payloads that match fingerprints of your secrets.

## Sources

- [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications/)
- [OWASP MCP Top 10](https://owasp.org/projects/mcp-top-10)
- [OpenCVE CVE-2026-75130 (Context7)](https://app.opencve.io/cve/CVE-2026-75130)