Egress firewall with domain rules and credential swapping; not a complete exfiltration defense.
Source discussion: OpenShell – A safe, private runtime for fleets of autonomous AI agents
“I've been using iron proxy recently for a project I just started, it does network restrictions by domain etc with plenty of options, credential swapping and more. I have no affiliation with it, but it solved most of what I need in one go when I was stressing out about it. Only real problem remaining if you truly want to be able to trust agents is how to prevent data (in my case codebases the agent works on) exfiltration a la HF incident. We can restrict network to trusted domains, but there's always a chance an agent could be extra slippery especially if prompt injected and doing something like pushing data out a few characters at a time.”
fennecbutt · recommendation · first hand use
Direct HN comment