Protocol
Constrain the coding agent's network path
Network access turns local context into a possible exfiltration and supply-chain path.
When it fits
- An agent can fetch arbitrary internet resources or send data to any host during coding.
When to avoid it
- Network controls have blind spots, especially through external tools or setup processes; combine them with tool permissions and context minimization.
Why it matters
Use an allowlist, firewall or equivalent egress policy appropriate to the task. Review blocked-request warnings rather than disabling controls reflexively. Give dependency registries and required services explicit access; keep unrelated destinations unavailable.
Steps
- Required hosts identified.
- Default egress policy known.
- Unexpected destinations blocked or reviewed.
- Blocked attempts visible.
- Exceptions time-bounded or justified.
An example
A build can reach the approved package registry but a new curl request to an unknown host is blocked and investigated.
Check your result
The agent cannot silently turn arbitrary repository content into arbitrary outbound requests.
Keep this limit in mind
- Network controls have blind spots, especially through external tools or setup processes; combine them with tool permissions and context minimization.
Connected ideas
Useful withAudit an MCP server before giving it repository context
Evidence and sources
GitHub's Copilot agent firewall provides network egress controls and blocked-request visibility while documenting that its coverage does not extend to every process or MCP path.
A firewall is one layer; external tools, setup steps and MCP servers need their own trust and permission controls.
Customizing or disabling the firewall for GitHub Copilot · Firewall behavior and limitations
OWASP's current secure-coding-with-AI guidance treats repository content, issues, PRs, comments, fetched pages, logs and tool responses as potential indirect prompt-injection inputs for coding agents.
Threat likelihood depends on who can influence the content and what permissions the agent has.
Secure Coding with AI Cheat Sheet · Indirect Prompt Injection in the Development Loop