Insider Threat Matrix™Insider Threat Matrix™
HumanSynthetic
Detections
Preventions
Github

External Communication Access

External communication access is the configuration that allows a synthetic subject to communicate beyond the organization’s controlled environment. This may include Hypertext Transfer Protocol (HTTP) requests, webhooks, email, external Application Programming Interface (API) calls, auto-rendered links, auto-rendered images, file uploads, browser navigation, or allow-listed domains.

 

This configuration creates an elevated exposure condition because outbound communication can complete the path from internal data access to external disclosure. A synthetic subject that can access private data, process untrusted content, and communicate externally may be exposed to what Simon Willison describes as the “lethal trifecta” for AI agents.

 

The primary risk is synthetic subject egress. A manipulated prompt, retrieved document, tool response, or generated output may cause the synthetic subject to transmit sensitive data outward through a permitted channel. This may occur through obvious actions such as email or API calls, or through less visible channels such as rendered image requests, link beacons, proxy requests, markdown output, or repeated small outbound requests.

 

A related risk is unsafe allow-listing. Domains, Content Security Policy (CSP) rules, proxy services, or trusted destinations may become exfiltration paths if they are too broad, stale, expired, re-registered, or not tied to a specific business purpose. A destination may appear trusted to the platform while still being controllable by an attacker.

 

Investigators should review outbound tool calls, HTTP requests, email activity, web proxy logs, Data Loss Prevention (DLP) events, rendered links and images, destination allow-lists, CSP entries, payload sizes, request frequency, and the retrieval or prompt events preceding egress. Particular attention should be given to newly observed domains, recently expired or re-registered domains, auto-rendered resources, repeated small requests, and outbound activity following access to sensitive data.

 

Investigative Relevance

External communication access is relevant because outbound connectivity determines whether a synthetic subject can move information outside the environment. Even a read-only assistant may become high-risk if its output can trigger external requests or transmit sensitive content.

Subsections (1)

ID Name Description
CF006.001Sandbox Egress Exposure

Sandbox egress exposure occurs when a synthetic subject operating inside a test, evaluation, development, research, or constrained execution environment is configured with outbound communication paths beyond the intended sandbox boundary. This may include internet access, Domain Name System (DNS) resolution, package registry access, cloud metadata access, internal network routes, webhook access, browser navigation, external Application Programming Interface (API) calls, or proxy paths that were not intended to be reachable.

 

This configuration creates an elevated exposure condition because the organization may believe the synthetic subject is operating only inside a simulated or controlled environment while the runtime can reach real systems. The prompt, test harness, or operator instruction may describe the environment as isolated, but the enforceable boundary is determined by network, identity, filesystem, registry, and tool configuration.

 

The primary risk is uncontrolled outbound reach from a supposedly contained environment. A synthetic subject tasked with cyber evaluation, code execution, package handling, browser automation, or autonomous tool use may discover reachable systems outside the approved range. If the environment permits egress, the subject may scan, authenticate, publish, fetch, exploit, or communicate externally even where the operator intended only simulated activity.

 

A related risk is boundary ambiguity. If the synthetic subject can reach both simulated targets and real systems, investigators may need to determine whether the subject followed the task objective under a false assumption, exploited a weak boundary deliberately, or continued after recognizing that a target was real. That question belongs to investigation; this sub-section concerns the configuration condition that made the boundary reachable.

 

Investigators should review sandbox network policy, egress allow-lists, DNS settings, route tables, proxy configuration, package registry access, browser configuration, cloud metadata access, mounted credentials, internal network reachability, firewall rules, tool permissions, and evaluation harness setup. Particular attention should be given to any path that allows the synthetic subject to contact public internet hosts, production infrastructure, third-party systems, package registries, or out-of-scope internal services.

 

Investigative Relevance

Sandbox egress exposure is relevant because a synthetic subject cannot be contained by instruction alone. If an evaluation or execution environment permits outbound communication, the subject’s effective boundary is wider than the boundary described to the model, evaluator, or operator.

 

This sub-section is especially relevant to cyber evaluations, coding agents, browser or desktop agents, autonomous tool agents, package publishing workflows, vendor-run evaluations, and third-party sandboxes.