All posts
Security
4 min read
Egress filtering for agents that browse
An agent with unrestricted network access is a liability. Allow‑lists at the VM boundary keep prompt injection from turning into data exfiltration.
Assume the model will be tricked
Prompt injection is not a bug you patch, it’s a property of the medium. The practical defence is to limit what a compromised agent can do. On Kernal, every machine has an egress policy enforced outside the guest, so even root inside the VM cannot reach a domain you did not allow.
Policies are declarative and versioned with your deployment. Most teams start with a handful of domains and expand as the agent proves itself.
