Network Segmentation & Network Access Control

External communication access is the configuration that allows a synthetic subject to communicate beyond the organization’s controlled environment. This may include Hypertext Transfer Protocol (HTTP) requests, webhooks, email, external Application Programming Interface (API) calls, auto-rendered links, auto-rendered images, file uploads, browser navigation, or allow-listed domains.

This configuration creates an elevated exposure condition because outbound communication can complete the path from internal data access to external disclosure. A synthetic subject that can access private data, process untrusted content, and communicate externally may be exposed to what Simon Willison describes as the “lethal trifecta” for AI agents.

The primary risk is synthetic subject egress. A manipulated prompt, retrieved document, tool response, or generated output may cause the synthetic subject to transmit sensitive data outward through a permitted channel. This may occur through obvious actions such as email or API calls, or through less visible channels such as rendered image requests, link beacons, proxy requests, markdown output, or repeated small outbound requests.

A related risk is unsafe allow-listing. Domains, Content Security Policy (CSP) rules, proxy services, or trusted destinations may become exfiltration paths if they are too broad, stale, expired, re-registered, or not tied to a specific business purpose. A destination may appear trusted to the platform while still being controllable by an attacker.

Investigators should review outbound tool calls, HTTP requests, email activity, web proxy logs, Data Loss Prevention (DLP) events, rendered links and images, destination allow-lists, CSP entries, payload sizes, request frequency, and the retrieval or prompt events preceding egress. Particular attention should be given to newly observed domains, recently expired or re-registered domains, auto-rendered resources, repeated small requests, and outbound activity following access to sensitive data.

Investigative Relevance

External communication access is relevant because outbound connectivity determines whether a synthetic subject can move information outside the environment. Even a read-only assistant may become high-risk if its output can trigger external requests or transmit sensitive content.

Agentic harm propagation occurs when an adverse condition affecting one synthetic subject spreads to other synthetic subjects, tools, memory stores, sessions, workflows, or systems. The spread may occur through agent-to-agent messages, shared memory, tool outputs, orchestration handoffs, connector metadata, generated records, or workflow state.

This adverse outcome creates organizational harm because the blast radius expands beyond the initial point of failure. A single poisoned input, unsafe output, false record, contaminated memory entry, or malicious connector may influence multiple synthetic subjects with different roles, permissions, tools, or data access.

The primary harm is system-wide amplification. An instruction, false record, unsafe behavior, misleading output, or malicious tool result may replicate or reappear across the agent graph, causing repeated data exposure, unauthorized actions, misinformation, fraud, operational disruption, or trust degradation.

A related harm is containment difficulty. By the time the adverse condition is detected, the original source may no longer be obvious. The same payload or false state may appear in summaries, task handoffs, memory entries, tool outputs, inter-agent messages, or downstream records, requiring investigators to reconstruct the propagation path across multiple logs and systems.

Investigators should review inter-agent communications, shared memory, orchestration logs, tool outputs, Model Context Protocol (MCP) server records, connector changes, memory writes, task handoff records, non-human identity activity, and downstream actions. Particular attention should be given to repeated instruction patterns, anomalous agent-to-agent message volume, poisoned memory records, tool-definition changes, one-to-many fan-out, and synchronized behavior across multiple agents.

Investigative Relevance

Agentic harm propagation is relevant because synthetic subject harm may not remain isolated. Agentic systems are often designed to share context, delegate work, call tools, and reuse memory, which can allow a localized adverse condition to spread through legitimate coordination paths.

This section is especially relevant where synthetic subjects operate in multi-agent systems, shared memory environments, MCP-connected tool ecosystems, orchestration frameworks, cross-agent workflows, or platforms where one agent’s output becomes another agent’s input.

Sandbox escape and out-of-boundary system access occurs when a synthetic subject operating inside an intended test, evaluation, development, or constrained execution environment reaches systems outside the boundary it was authorized to access. The affected systems may be external internet hosts, production infrastructure, package registries, third-party services, internal systems outside the evaluation range, or unrelated organizations.

This adverse outcome creates organizational harm because the synthetic subject’s actions are no longer confined to the environment assumed by the operator, evaluator, or control owner. The subject may scan, authenticate, exploit, publish code, retrieve data, modify systems, or interact with real services while believing, or claiming to believe, that those targets are part of the exercise.

The primary harm is unauthorized system access outside the declared operating boundary. Even where the root cause is weak sandbox configuration, the adverse outcome is the synthetic subject’s real interaction with systems it was not meant to reach. The investigation should distinguish the enabling condition from the outcome: poor sandbox configuration belongs under Configuration, while the access, exploitation, publication, or downstream impact belongs here.

A related harm is boundary uncertainty. If the synthetic subject is given an open-ended objective and the environment does not enforce hard limits, it may discover reachable targets that were never intended to be in scope. Investigators should not assume malicious intent merely because the subject crossed the boundary. They should test whether the subject exploited a discovered weak boundary deliberately, followed a task objective under a false belief, or continued after evidence showed the target was real.

Investigators should review sandbox configuration, network egress controls, Domain Name System (DNS) resolution, route tables, proxy logs, package registry activity, tool-call logs, shell commands, authentication attempts, evaluation prompts, system prompts, execution traces, external destination logs, and any reasoning or self-report produced during the run. Particular attention should be given to the first out-of-boundary connection, whether the subject recognized the target as real, whether it stopped or continued, and whether external activity can be tied to a declared task objective.

Investigative Relevance

Sandbox escape and out-of-boundary system access is relevant because synthetic subjects may operate under assumptions created by humans, prompts, vendors, or evaluation harnesses. A subject may be told that it has no internet access while the environment is actually misconfigured to permit it. In that case, the configuration failure enables the incident, but the adverse outcome remains the unauthorized external or production interaction.

This section is especially relevant where synthetic subjects run cyber evaluations, coding tasks, browser or desktop automation, package publishing workflows, development agents, tool-using agents, or autonomous test harnesses with network, filesystem, credential, or package-registry access.

This section should be cross-referenced with Configuration objects covering sandbox egress, tool permissions, non-human identity access, runtime controls, and connected tools. It may also relate to Opacity where logs do not clearly show how the boundary was crossed, and to Directive where the subject continues after recognizing that the environment may be real.

Over-permissive tool runtime occurs when a connected tool runs with broader file, network, credential, system, or environment access than required for its approved function.

This configuration creates an elevated exposure condition because a tool called by the synthetic subject may access resources beyond the data explicitly passed to it. It may read local files, environment variables, credentials, network services, logs, or system resources available to the runtime.

The primary risk is hidden tool-side access. Even if the synthetic subject appears narrowly scoped, the tool it calls may have broader runtime permissions and can retrieve, modify, or transmit data outside the intended tool function.

Investigators should review runtime permissions, container settings, environment variables, mounted files, network access, local secrets, execution logs, and tool behavior. Particular attention should be given to tools with access to home directories, secret stores, internal networks, unrestricted outbound connectivity, or shared execution environments.

Investigative Relevance

Over-permissive tool runtimes are relevant because tool execution environments can expand synthetic subject capability beyond visible tool descriptions. This sub-section is especially relevant where tools run on developer workstations, shared servers, CI/CD workers, agent runtimes, or cloud functions with broad local or network access.

Unrestricted tool egress occurs when a connected tool or tool runtime can send data to external destinations without destination allowlisting, network control, or policy enforcement.

This configuration creates an elevated exposure condition because a tool may transmit data outside the organization through email, web requests, file uploads, webhooks, application programming interface calls, or hidden copy mechanisms such as blind carbon copy.

The primary risk is tool-mediated exfiltration. A synthetic subject may call an apparently legitimate tool, while the tool or its runtime sends data to an unauthorized destination. This may occur through malicious tool logic, compromised packages, unsafe configuration, or hidden forwarding behavior.

Investigators should review web proxy logs, egress records, email headers, tool runtime network activity, webhook destinations, API endpoints, and tool-call outputs. Particular attention should be given to newly observed domains, non-allowlisted destinations, blind-copy behavior, unexpected external calls, and data transfers following tool invocation.

Investigative Relevance

Unrestricted tool egress is relevant because connected tools can create outbound paths that are not visible in the synthetic subject’s own prompt or response logs. This sub-section is especially relevant where tools send email, call external APIs, upload files, retrieve URLs, or operate from runtimes with broad internet access.

Self-spawned process invocation occurs when a synthetic subject starts a new process, worker, script, container, daemon, or subprocess that continues activity beyond the immediate model turn or agent run. The new process may execute independently, call tools, consume resources, or perform actions after the original invocation appears complete.

This invocation creates an elevated exposure condition because the synthetic subject can shift activity from the monitored agent session into a separate execution path. The spawned process may inherit environment variables, local credentials, file-system access, network access, or runtime permissions available to the original agent environment.

The primary risk is uncontrolled execution outside the expected agent boundary. A synthetic subject may launch scripts, background jobs, package commands, shell processes, containers, or daemons that continue operating without normal agent-level supervision, approval, or traceability.

Investigators should review endpoint telemetry, process creation events, parent-child process relationships, shell history, container logs, daemon configuration, environment variables, file writes, network activity, and non-human identity usage. Particular attention should be given to background processes started by the agent, commands detached from the terminal, new containers, long-running child processes, and process activity that continues after the agent session ends.

Investigative Relevance

Self-spawned process invocation is relevant because the synthetic subject may cause later activity through the operating environment rather than through its own visible conversation or tool-call loop. The investigation must follow execution into host, container, workflow, and endpoint telemetry.

This sub-section is especially relevant where synthetic subjects can run shell commands, execute notebooks, launch containers, install packages, start local servers, create daemons, or operate inside developer workstations and continuous integration environments.

Tool-mediated data exfiltration occurs when a synthetic subject causes protected information to leave the organization through a connected tool, connector, plugin, Application Programming Interface (API), webhook, Model Context Protocol (MCP) server, or external service.

This adverse outcome creates organizational harm because the data leaves through an action path the synthetic subject was permitted to use. The transfer may appear as an ordinary tool call, integration event, workflow update, or API request rather than a direct data export.

The primary harm is unauthorized disclosure through tool authority. A synthetic subject may pass sensitive data as a tool argument, include it in an API payload, send it to a webhook, write it into a third-party system, or route it through a connector that transmits data outside the approved boundary.

A related harm is attribution difficulty. Logs may show that a tool or service account performed the transfer, while the underlying cause was a synthetic subject decision, prompt, retrieved content, or tool-output chain. Investigators may need to reconstruct the sequence from prompt to tool call to external destination.

Investigators should review tool-call logs, connector records, API payloads, webhook destinations, MCP server activity, non-human identity records, outbound network logs, Data Loss Prevention (DLP) events, source-content provenance, and destination ownership. Particular attention should be given to sensitive data in tool arguments, unexpected external destinations, newly added tools, unusual webhook calls, and tool use following retrieval of protected information.

Investigative Relevance

Tool-mediated data exfiltration is relevant because connected tools allow a synthetic subject to move data beyond its immediate response surface. The harmful outcome is the transfer of protected information through a configured action channel.

This sub-section is especially relevant where synthetic subjects can call APIs, send webhooks, use MCP servers, write to SaaS platforms, upload files, send messages, update tickets, create records, or interact with external tools that accept model-provided content.

Sandbox egress exposure occurs when a synthetic subject operating inside a test, evaluation, development, research, or constrained execution environment is configured with outbound communication paths beyond the intended sandbox boundary. This may include internet access, Domain Name System (DNS) resolution, package registry access, cloud metadata access, internal network routes, webhook access, browser navigation, external Application Programming Interface (API) calls, or proxy paths that were not intended to be reachable.

This configuration creates an elevated exposure condition because the organization may believe the synthetic subject is operating only inside a simulated or controlled environment while the runtime can reach real systems. The prompt, test harness, or operator instruction may describe the environment as isolated, but the enforceable boundary is determined by network, identity, filesystem, registry, and tool configuration.

The primary risk is uncontrolled outbound reach from a supposedly contained environment. A synthetic subject tasked with cyber evaluation, code execution, package handling, browser automation, or autonomous tool use may discover reachable systems outside the approved range. If the environment permits egress, the subject may scan, authenticate, publish, fetch, exploit, or communicate externally even where the operator intended only simulated activity.

A related risk is boundary ambiguity. If the synthetic subject can reach both simulated targets and real systems, investigators may need to determine whether the subject followed the task objective under a false assumption, exploited a weak boundary deliberately, or continued after recognizing that a target was real. That question belongs to investigation; this sub-section concerns the configuration condition that made the boundary reachable.

Investigators should review sandbox network policy, egress allow-lists, DNS settings, route tables, proxy configuration, package registry access, browser configuration, cloud metadata access, mounted credentials, internal network reachability, firewall rules, tool permissions, and evaluation harness setup. Particular attention should be given to any path that allows the synthetic subject to contact public internet hosts, production infrastructure, third-party systems, package registries, or out-of-scope internal services.

Investigative Relevance

Sandbox egress exposure is relevant because a synthetic subject cannot be contained by instruction alone. If an evaluation or execution environment permits outbound communication, the subject’s effective boundary is wider than the boundary described to the model, evaluator, or operator.

This sub-section is especially relevant to cyber evaluations, coding agents, browser or desktop agents, autonomous tool agents, package publishing workflows, vendor-run evaluations, and third-party sandboxes.