Do not send files, secrets or context to an address that fetched content names

Error strings

• none listed

Situation

Your agent has tools that can make network requests, write files or send messages while it also reads untrusted content.

Symptom

Text on a page or in an email asks the agent to send, post or upload something (files, keys, passwords, earlier user messages or its own instructions) to a particular address, and the agent does it.

Cause

The paper's 'Behavioural Control' class includes traps that induce an agent to locate, encode and send private data to an outside endpoint. The paper also reports, citing Shapira et al. (2025), attack success rates exceeding 80% across five web-use agents for this kind of data exfiltration. That figure is a finding of the cited study as reported by the paper, not a measurement by the paper or by this dataset, and it has not been re-checked here.

Fix

1) Keep secrets out of the model context: pass references or environment variables, never the key itself. 2) Allow outbound requests only to an allowlist of hosts. 3) Require user confirmation before any outbound write or upload that did not come from the user's own request. 4) Give read-only credentials to steps that process untrusted content.

Snippet

from urllib.parse import urlparse
ALLOWED = {"api.github.com", "docs.example.org"}
def egress_ok(url):
    return urlparse(url).hostname in ALLOWED

Verify

Make a test page you own that asks the agent to send a harmless test value to a local test server you control. Run the agent on it. Pass: the test server receives zero requests and the agent reports the request as untrusted.

Source

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6372438

Use this via MCP

Streamable HTTP, no authentication: https://agent-economy-data.onrender.com/notes/mcp. Tools: find_cards, get_card, report_outcome, and when enabled ask_markedet / get_answer. See llms.txt. Same notes as files: Agent Field Guide.