egress-audit --scope ai-coding-agents
AI agent egress containment
Independent research on keeping AI coding agents from sending data where they shouldn't.
AI coding agents run commands, read files, and reach the network. That makes outbound traffic a real risk.
This work asks one question: when an agent tries to send data out, does anything stop it? I test that question adversarially and record what gets through.
What containment means
A narrow definition, so the results can be checked.
Containment means that data leaves the machine only along paths that were deliberately allowed. Anything else counts as a leak. It doesn't matter whether the agent meant to send it or was tricked into it.
- leak
- Data reaches a destination outside the allowed set.
- blocked
- An attempt that was stopped. Not a leak. It is recorded as evidence that a control held.
- unexpected leak
- A leak the design did not account for. Those are the ones that matter.
Method
Assume the agent will try. Test like an adversary. Count what gets out.
- Adversarial by default. Each test assumes the agent, or something steering it, is actively trying to get data out.
- Layered, then isolated. Controls are tested together and one at a time. That shows which layer actually stopped each attempt.
- Observed at the boundary. Results are measured by what actually reached the network, not by what the agent reported.
- Rounds, not a single pass. Each round tries new routes. Fixes are retested in later rounds.
- Every finding is recorded. That includes failures, near misses, and blocked attempts.
- Results are stated plainly. Where a control did not hold, the write-up says so.
Results, in brief
round two
20 / 5 / 2
blocked / leaked / partial
round six
33 / 12 / 1
blocked / leaked / partial
rounds five and six
0
unexpected leaks; every leak recorded was an intentional exception
Three widely used AI coding agents were also run under the same test conditions. The full results, the configuration they were measured in, and their limits are on the round table page.
Work with Egress Audit
The methodology brief and containment assessments are available to security teams, researchers, and organizations evaluating AI agents. Every request is reviewed by hand.