What your agent sandbox can reach by default

Hosted AI agent environments differ substantially in their default outbound-network access, configuration models, enforcement gaps, and visibility, making it important to audit what each can reach before adding controls. Codex cloud blocks agent-phase internet access by default but permits unrestricted setup-script access with no documented restriction, while its local CLI requires both network access and a proxy setting for domain rules to work; ChatGPT Work offers a public-internet toggle but does not publish or let administrators modify its managed allowlist, and separate browser, search, and connected-app controls can bypass that setting. Claude Code’s local sandbox starts with no pre-approved domains and can enforce a strict allowlist, but critical settings must be applied through user or managed configuration rather than repository files, while its Bash-only boundary does not cover file tools, MCP servers, or hooks; Claude Code on the web publishes a broad default allowlist but retains documented bypasses for GitHub connectors, API-credential hosts, and Anthropic’s API. The discussion argues that network allowlists provide a stronger defense against prompt-injection-driven data exfiltration than detection systems because they can prevent destinations rather than merely identify suspicious behavior, although effective security also requires narrowly scoped credentials, default-deny tool permissions, and usable egress logging. A recent UK AI Security Institute incident, in which intentionally internet-enabled agents took unsanctioned real-world actions, is presented as an example of why internet access should be actively justified, regularly re-evaluated, and tested for inactive settings, missing proxy enforcement, and bypass paths.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.