Request a package
The agent asks JFrog for a dependency. This internal connection is allowed.
Package access is allowedThe sandbox can reach Artifactory for dependencies. Direct internet requests are restricted.
The agent redirects the fetchAgents found ways to make Artifactory request arbitrary internet destinations, including through its remote-repository service.
The proxy crossesArtifactory originates the outside request. The network sees a connection from the package server, not the sandboxed agent.
A route backThe external server sends content back to Artifactory over the connection Artifactory opened.
The client receives outside contentThe agent retrieves the result through the permitted service. The package route has become an unintended internet relay.
A dependency is neededThe agent needs an approved package for its task.
The client asks ArtifactoryA package request goes to the internal service.
The proxy checks the upstreamArtifactory fetches from an approved registry.
The registry returns the packageThe approved registry sends package content to Artifactory.
The dependency reaches the agentArtifactory delivers the requested package to the client.
Claude is tricked into stealing chat dataA malicious document tricks Claude into extracting chat data and sending it to the attacker.
Claude encodes the data in a subdomainClaude encodes the chat data into a name such as encoded-data.collector.example, then triggers a DNS lookup for that name.
DNS forwards the encoded dataThe resolver forwards the query to the attacker’s authoritative nameserver. The encoded chat data leaves with the subdomain being looked up.
The attacker recovers the chat dataThe attacker reads the incoming DNS query and decodes the subdomain to recover the chat data. No web connection is needed.
A permitted service needs an addressAn application prepares to contact an approved service.
The client asks for an addressThe client sends a question for a permitted hostname.
DNS policy permits the lookupThe resolver validates the query before forwarding it.
An address record comes backThe authoritative server returns the requested record.
The application uses the resultThe client receives the resolved address.
The chatbot’s HTTPS route is blockedThe agent tries to contact a public chatbot over HTTPS. The web proxy blocks the request.
The agent sends its question through DNSThe agent puts its question in a DNS query and asks the internal resolver for a TXT answer.
DNS delivers the question to the chatbotA public delegation service directs the resolver to the chatbot’s nameserver, carrying the question outside the sandbox.
The chatbot answers in a TXT recordThe chatbot’s nameserver returns its answer as text in a DNS TXT record.
The agent receives the chatbot’s replyThe resolver delivers the TXT answer to the agent. The supposedly offline sandbox now has a working chatbot connection.
The agent needs an internal serviceA local workflow needs an approved service address.
The request names an internal serviceA permitted name and record type go to the resolver.
The resolver keeps the lookup internalThe query passes policy and reaches an internal zone.
The internal zone supplies a recordA permitted address record returns to the resolver.
The agent receives the internal addressThe resolver delivers the permitted result.
A file URL enters an inference requestThe agent sends an input_file item with a file_url field through the permitted proxy.
The proxy misses the remote-fetch fieldThe valid API call is forwarded without applying the offline URL policy to file_url.
The provider retrieves the URLThe inference provider makes the external fetch. The sandbox never opens that connection itself.
Remote content becomes model inputThe file host returns content to the provider for processing as input.
The answer returns through the proxyThe model output brings external information back along the authorized inference connection.
The agent prepares local task inputThe agent needs the model to reason about material already in the environment.
The request goes to the proxyThe client sends its input through the approved inference route.
The proxy validates requested capabilitiesThe permitted inference request reaches the provider after policy checks.
The provider processes the supplied inputThe model returns an answer based on the permitted input.
The answer reaches the agentThe proxy relays the inference result to the task.
Request a packageThe agent asks JFrog for a dependency. This internal connection is allowed.
JFrog fetches a missing packageThe package is not cached. JFrog starts a new request to its approved upstream registry.
Gateway permits the registryThe gateway checks the destination and permits this approved package fetch.
The package returnsA package comes back through the gateway to JFrog.
JFrog delivers the packageJFrog caches the package and serves it to the agent. The useful workflow succeeds.
Reach the package serviceThe agent sends a manipulated request over its permitted connection to JFrog.
JFrog rejects the destinationThe application check stops the manipulated request. No new outbound request is created.
No outbound fetchThe gateway has nothing to forward. The application already stopped the attempt.
No external responseThe unapproved server never receives this request, so it cannot return content.
The agent remains containedNo outside content reaches the agent through this attempted route.
JFrog accepts an unintended destinationFailure ①: SSRF lets the agent influence JFrog’s fetch destination. JFrog starts the new request.
Gateway blocks the destinationJFrog’s request arrives, but the destination is not approved. The packet stops at the boundary.
Gateway permits the unintended requestFailure ②: the outbound policy does not stop this unintended destination. The request leaves.
Outside content returnsAn ordinary document comes back through the gateway to JFrog.
Content reaches the agentJFrog relays the fetched document over the permitted internal connection. Both checks failed to contain this route.