Verified65% confidenceDecision RuleExact time
The network egress of an agent sandbox should adopt a strict whitelist mode, allowing access only to explicitly listed domain names and endpoints, and blocking everything else.
3
Sources
65%
Confidence
Long-term
Relevance
9/20/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedApplication-layer whitelists (such as allowing access only to specific domains) rely on DNS resolution and proxy configuration and are easy to bypass; network-layer firewall or security group rules intercept at a lower level and are harder to evade.76% similarUnverified在局域网中开放 Web 服务时，建议配置 HTTP Basic Auth 认证或 IP 白名单限制以防止未授权访问76% similarUnverifiedIn whitelist mode, an egress firewall denies all outbound connections by default, only allowing traffic that matches predefined rules (destination IP/CIDR, port, protocol, domain name).71% similarUnverifiedIt is recommended to run AI coding agents in a sandboxed or containerized environment, restricting outbound traffic through network policies to allow access only to whitelisted addresses.69% similarUnverifiedPrivate repository proxies usually have a whitelist of remote repositories they are allowed to access; if the new repository is not on the whitelist, the proxy will directly reject the request, manifesting as 'artifact not found' rather than a network error.69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/937219API
curl https://kongchang.com/api/v1/knowledge/claims/937219MCP
get_claim(id=937219)