What is Egress Control?
Also called Outbound Traffic Filtering, Egress Filtering.
Egress control is the restriction of outbound network connections from a system to an explicitly approved set of destinations. In AI deployments it is a primary defense against data exfiltration, because an agent that has been manipulated through injected instructions still cannot send data anywhere the network policy does not permit.
Most security effort goes into inbound controls, but exfiltration is an outbound event. When an agent reads untrusted content and is steered into leaking data, the leak requires a connection: a request to an attacker controlled endpoint, an image loaded from a crafted address, a webhook to an unfamiliar host. Denying outbound traffic by default removes the delivery channel even when the manipulation succeeded.
Implementation combines network policy with application layer inspection. Default deny rules at the network boundary, an explicit destination allowlist, a forward proxy that logs and authorizes each request, and DNS restrictions that prevent resolution of arbitrary names all contribute. Because names can be resolved to permitted addresses, controls that operate on the requested hostname and path are more precise than address filtering alone.
AI specific channels are easy to overlook. Markdown images and links in rendered output can trigger requests to attacker chosen addresses when displayed, retrieval tools can be pointed at arbitrary URLs, and code execution environments can open sockets directly. Each of these is an egress path, so the control has to cover rendering surfaces and tool implementations, not just the server's firewall.
The operational cost is maintenance. Allowlists drift as integrations are added, and an overly rigid policy leads teams to widen rules broadly to unblock work, which quietly restores the original exposure. Sustainable setups make requesting a destination easy and reviewable, log denials so legitimate needs surface quickly, and alert on unusual outbound volume rather than relying only on the deny list.
Key points
- Default deny outbound, allow only approved destinations
- Blocks exfiltration even when injection succeeded
- Use a logging proxy and hostname aware rules, not addresses alone
- Cover rendered links and images, fetch tools and code sandboxes
- Make exceptions easy to request or the policy gets widened
In practice
An assistant summarizes web pages. A malicious page contains hidden text instructing it to append the user's private notes to an image URL on an external host. The instruction is followed, but the runtime allows outbound connections only to the model provider, the internal document service and two named integrations. The request is denied at the proxy, the denial is logged with the full destination, and the attempt is investigated the same day.