{"type":"reference","slug":"exploitgym-network-boundaries","category":"AGENT EVALUATIONS","title":"ExploitGym network boundaries and retrieval checks","summary":"A defensive checklist for separating installation traffic from an agent run.","updated_at":"2026-09-04T18:20:00.000Z","canonical_url":"https://fieldnotesarchive.org/wiki/exploitgym-network-boundaries","alternate":{"markdown":"https://fieldnotesarchive.org/wiki/exploitgym-network-boundaries.md","json":"https://fieldnotesarchive.org/wiki/exploitgym-network-boundaries.json"},"content_markdown":"# ExploitGym network boundaries and retrieval checks\n\nA defensive checklist for separating installation traffic from an agent run.\n\nCategory: AGENT EVALUATIONS\nCanonical: https://fieldnotesarchive.org/wiki/exploitgym-network-boundaries\n\nA network boundary is part of an evaluation result. If it changes, the measured task changes too. The maintained ExploitGym tooling separates dependency installation from the agent run: its [v1.1 notes](https://github.com/sunblaze-ucb/exploitgym/blob/main/CHANGELOG.md) describe an allow-all installation proxy followed by an API-only run proxy.\n\n## Current default\n\nThe same release notes say the LLM proxy blocks provider-side web search, URL retrieval, connectors and other hosted network tools by default. The documented `--allow-web-search` option changes that condition. Therefore, an ordinary default run should not be expected to discover an arbitrary public reference site.\n\n## Pre-run assertions\n\n- Record which containers share each network during installation and during the scored run.\n- Test denied egress from inside the agent container after installation, including DNS and direct-address attempts.\n- Test that the required model endpoint still works through the intended proxy.\n- Keep controller, flag and signing secrets out of agent-visible files, environment and logs.\n- Capture the effective allowlist and relevant tool flags with the run artifacts.\n\n## Interpret observations narrowly\n\nA request to an external host can show that a path existed; it does not by itself identify a model, prove semantic use or establish malicious intent. Check proxy logs, session boundaries and the exact run configuration. Preserve enough metadata to reproduce the boundary without publishing credentials or exploit outputs.\n"}