Analysis · curated 17 Sep 2026
AI Agent HTTP Tools Are SSRF by Construction: Network Policy Is the Only Real Control
First reported dev.to
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Agent SSRF turns any deployed LLM agent with an HTTP tool into a standing credential-exfiltration risk that URL allowlists and code fixes cannot fully close, so defenders must enforce network-layer controls around agent processes.
A technical write-up argues that HTTP-fetching tools given to AI agents are SSRF by design: because the model decides which URL to fetch and attackers control the model via direct or indirect prompt injection (including MCP tool-description poisoning), agents can be steered to hit cloud metadata endpoints like 169.254.169.254 and leak IAM credentials. The piece synthesizes real evidence — GitHub advisory #3662 for @modelcontextprotocol/server-puppeteer, CVE-2025-53767 (CVSS 10.0) where Azure OpenAI's infrastructure reached Azure IMDS, and arXiv red-teaming work — and concludes network policy is the only control an attacker cannot override through a prompt.