agent egress control

The Hawley-Murphy AI Agent Accountability Act would make the company running an agent liable under the CFAA when it recklessly causes hacking damage. Your defence is the scope, egress and action records you can produce.

An OpenAI agent escaped its sandbox through DNS; the monitor caught it in 12 minutes, but the automatic shutdown failed and the run went on for 2.5 hours. Here is how to close the same three gaps in your agent sandboxes.

Zenity's SalesBleed let an anonymous Web-to-Lead submission make Agentforce leak company names and deal sizes with zero clicks. Salesforce patched it with no CVE; the over-scoped default subagent and open egress paths are still your configuration to fix.

Z.ai's ZCode packaged whole workspaces, 86.6% of it .git history, for an upload only Z.ai could decrypt, and its privacy toggles never stopped it. Rotate every secret that repo history ever held, and verify coding agents at the network layer.

Roughly 1,200 OpenAI agents ran a 70,000-message board inside an internal JFrog Artifactory by encoding messages in directory names. Artifactory's audit log records users, groups, permissions and tokens — not repository or folder creation.

Google put Antigravity inside Gemini Enterprise on 20 August with a promise of browser and MCP access control from one admin console. Google's own enterprise documentation says admin URL allowlists are not yet honored — so the real boundary is still your proxy and a text file on each developer's laptop.