Server-Side Request Forgery (SSRF) attacks trick an agent into making requests to internal services that the attacker cannot reach directly. When an AI agent has network access and accepts user-influenced URLs, it becomes an SSRF proxy that bypasses network boundaries.
An agent with web browsing or HTTP request tools fetches URLs as part of its tasks. An attacker provides a URL that points to an internal service: http://169.254.169.254/latest/meta-data/ (AWS metadata endpoint) or http://internal-admin.local/api/users. The agent, running inside your network, can reach these services even though the attacker cannot.
The agent fetches the internal resource and returns the content to the attacker, either directly in its response or by leaking it through a side channel.
The most dangerous SSRF variant targets cloud metadata endpoints. AWS, GCP, and Azure all expose instance metadata on link-local addresses. This metadata often contains temporary credentials, instance roles, and configuration data. An agent tricked into fetching metadata URLs can leak credentials that grant broad cloud access.
Attackers use DNS rebinding to bypass URL validation. The URL initially resolves to a public IP, passing validation checks. Seconds later, the DNS record changes to an internal IP. When the agent makes the actual request, it hits the internal service.
IP validation after DNS resolution. Resolve the URL, check the resulting IP against blocked ranges (private, link-local, loopback), and make the request using the resolved IP. This defeats DNS rebinding.
Block internal ranges. Authensor's policy engine can evaluate HTTP request actions and block requests targeting private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local addresses (169.254.0.0/16).
Domain allowlisting. Restrict the agent to fetching URLs from approved domains only. This is the strongest defense against SSRF.
Network segmentation. Run agents in a network segment that cannot reach internal services. Use network policies (in Kubernetes) or security groups (in cloud) to enforce this boundary.
Disable redirects or validate redirect targets. An attacker might provide a URL that redirects to an internal address, bypassing the initial URL check.
Log every outbound request with the target URL, resolved IP, and response status. Alert on requests to private IP ranges or cloud metadata endpoints. Authensor's audit trail captures these events for investigation.
Explore more guides on AI agent safety, prompt injection, and building secure systems.
View All Guides