---
title: "Comment by Ahmet Özel on \"The current state of security for autonomous agents in the cloud\" | Hashnode"
description: "Treating prompt injection as intrinsic and then asking what a hijacked plan has to get through is the right way round, and it is the framing most agent-security"
url: "https://hashnode.com/posts/the-current-state-of-security-for-autonomous-agents-in-the-cloud/6ab0602e91fdd25260202a80/comment/6ab0cbed5c6d4b6d7ac946d6"
---

[Discussion](https://hashnode.com/posts/the-current-state-of-security-for-autonomous-agents-in-the-cloud/6ab0602e91fdd25260202a80)

Comment [The current state of security for autonomous agents in the cloud](https://hashnode.com/posts/the-current-state-of-security-for-autonomous-agents-in-the-cloud/6ab0602e91fdd25260202a80)

[Ahmet Özel](https://hashnode.com/@ahmetozel)

[Sep 21](https://hashnode.com/posts/the-current-state-of-security-for-autonomous-agents-in-the-cloud/6ab0602e91fdd25260202a80/comment/6ab0cbed5c6d4b6d7ac946d6)

Treating prompt injection as intrinsic and then asking what a hijacked plan has to get through is the right way round, and it is the framing most agent-security writing gets backwards by starting at the prompt.

Putting the tool broker outside the model is the load-bearing piece, because it is the only control that still holds when the model is fully compromised.

One addition to the egress plane: deny-by-default is necessary, but the allowlist erodes, and every allowed domain is an exfiltration channel for anything the agent can read. Worth reviewing that list on a schedule rather than only at the moment something gets added to it.

[Nivethitha Kumaravelu](https://hashnode.com/@eternalnebula)

[Sep 21](https://hashnode.com/posts/the-current-state-of-security-for-autonomous-agents-in-the-cloud/6ab0602e91fdd25260202a80/comment/6ab0cbed5c6d4b6d7ac946d6#reply-6ab13e3598927792731e39c4)

The egress is critical indeed. Even benign egress can be used as a proxy for exfiltration, as you mentioned. Reviewing the list and monitoring the tool calls/audit logs should help.

[Ahmet Özel](https://hashnode.com/@ahmetozel)

[Oct 4](https://hashnode.com/posts/the-current-state-of-security-for-autonomous-agents-in-the-cloud/6ab0602e91fdd25260202a80/comment/6ab0cbed5c6d4b6d7ac946d6#reply-6ac2963b8e7de5c668c30619)

Monitoring tool calls helps, but I would also capture whether an allowed request changed its destination after a redirect. Reviewing only the initial hostname can leave the effective egress path invisible, especially when an otherwise benign endpoint forwards elsewhere.

A focused audit test could send an allowed request through a redirect and require the final destination to receive its own policy decision. Recording the method and destination at each hop would make the review you suggest more concrete, without relying on the model's description of what it intended to send.