AI Agent Network Security: Where Destination Control Gets Enforced

Summarize with:

ChatGPTClaudePerplexityGoogle AIGrok

AI agent network security comes down to one decision: where do you enforce the rule about where an agent is allowed to send data? In late October 2026, vendors put that rule in a gateway, on the endpoint, in the segmentation layer, and in silicon. Each position sees something different and misses something different.

This article compares them and asks the same question of each one: what happens when the agent runs somewhere the control is not installed?

The Decision Inside Every Agent Security Pitch

Destination control is the rule that decides which hosts, services, and addresses an AI agent can reach. It applies to every outbound connection the agent makes: a call to a model provider, a connection to an MCP server, a request from a code interpreter, a package download at runtime.

It matters because an agent that has been manipulated, misconfigured, or compromised still has to open a connection to do harm outside your environment. Prompt injection, a stolen token, and an over-broad tool grant are different causes with different fixes. They end at the same step.

The destinations attackers choose are ordinary ones. In an October 21 analysis of AI-assisted cybercrime, Unit 42 described an agent controlled through Telegram, password hashes sent to GPU instances on Vast.ai, and results reported back through Discord webhooks. All three are commercial services that plenty of companies use legitimately, which is why a list of known-bad domains does not catch them. A list of approved destinations does, because the agent has no approved reason to contact them. The rule that works is default-deny with a short allow-list per agent, and the open question is which position in the architecture enforces it.

Teams are already seeing the result of leaving that rule unwritten. Illumio and Sapio Research surveyed 1,100 IT and security decision-makers across 10 markets and found that 26% had an AI agent or tool connect to systems without security approval, and 24% said AI had accessed data it should not have reached.

Four Positions and Four Claims in One Week

Between October 19 and 25, 2026, four security vendors published material on controlling where AI agents send traffic. They put the control in four different places.

The gateway or proxy. In its NVIDIA OpenShell release, Zscaler said an agent told to "send those records to an outside address" is "stopped in transit." Its ThreatLabz team separately recommended routing server egress through ZIA after the PHP2Shell vulnerabilities. Palo Alto described its AI Gateway as governing connections to "LLMs, MCP servers, APIs and enterprise services."

The endpoint. Palo Alto's Cortex XDR 6.0 "intercepts the outgoing prompts" to "enforce real-time blocking across all model destinations." CrowdStrike's Falcon Guardian post contrasted endpoint visibility with "tools that rely on inspecting network traffic," and described an endpoint agent that tried "public data-sharing websites."

Segmentation. Akamai argued that application logs record what an agent intended to do but not the network connections it actually made. Its answer is L3/L4 microsegmentation as a "radar system" that flags "unsanctioned external callouts" and "API destinations."

Silicon. Palo Alto announced that AI Runtime Security on NVIDIA BlueField DPUs is generally available for AI factory and industrial edge deployments, with policies "enforced in silicon." CrowdStrike and Zscaler have announced plans for their own BlueField integrations.

Unit 42 added a plain recommendation in an October 15 report on an AI-powered espionage campaign: enforce strict outbound firewall rules.

None of the four placed destination control in the network path between clouds.

What Each Position Can See and Stop

A gateway or proxy

A gateway sees the traffic that is sent to it, and it can stop that traffic. The weak point is routing. Every workload has to be configured to send agent traffic through the gateway, and anything that takes a different route never meets the policy. Zscaler's own advisory frames the fix as a routing decision for server egress, which is the right instinct. It also shows where the effort lands: someone has to make sure every route goes through the gateway.

The endpoint

The endpoint has something no network device has. It knows which process opened the connection and can see the prompt before it leaves. CrowdStrike and Palo Alto are right to point at that.

It also needs software on the host. Agents run in serverless functions that exist for seconds, in managed container services where nothing can be installed, and in accounts the security team does not control. Where nothing can be installed, the endpoint position has nothing to enforce with.

Segmentation

Akamai's observation is the sharpest in the set. A log that says what an agent meant to do is not a record of what it did, and a flow-level view closes that gap.

The limit is resolution. An L3/L4 rule sees an address and a port. It cannot tell the model provider's API hostname from another tenant on the same cloud address range, and it cannot tell a permitted URL path from a forbidden one on the same host. Segmentation answers which workloads may talk to which, but the external hostnames an agent may reach is a separate rule.

Silicon

Enforcement on a DPU sits outside the host, so a compromised host cannot switch it off. That is the strongest isolation on the list. It works where the hardware is installed, which Palo Alto scoped to AI factories and industrial edge. The question for everything else is covered in a companion piece on NVIDIA OpenShell security and workloads without a DPU.

The Network Path as a Fifth Position

Every one of those agents reaches its destination over a network path: from the workload, through the cloud network, out to the model provider, MCP server, or tool endpoint. Enforcing at that point has four properties the other positions lack together.

It needs no software on the workload, so a serverless function and a long-running VM get the same treatment. It sees traffic across VPCs, VNets, accounts, and clouds, so there is one policy where there would otherwise be several. It can apply policy by workload identity, which holds when cloud IP addresses change. And it can apply policy by hostname and, with selective TLS decryption, by URL path, so a compromised dependency calling a legitimate host gets caught at the path.

This is how Aviatrix approaches it. The Distributed Cloud Firewall enforces default-deny at the spoke gateway in the agent's own VPC or VNet. Outbound agent traffic is covered on the paths that matter: tool calls, MCP server connections, model provider traffic, and code interpreter outbound. Identity-aware groups define east-west boundaries, FQDN allow-lists define permitted destinations, and selective decryption handles the path-level cases. Detection tells you what happened, but containment determines how bad it gets.

The same mechanism is what blocking data exfiltration depends on, and it extends the older argument for egress filtering to agents that choose their own destinations at runtime.

Five Questions for Any Vendor

Ask these of every position, including this one.

• Where does enforcement happen, and can a compromised workload change the policy?

• What has to be installed, and where can it not be installed?

• What does it see across accounts and clouds, not just inside one?

• What happens when an agent contacts a destination nobody listed: deny, or alert?

• Can it tell a permitted host from a permitted path on that host?

A gateway scores well on the first question and depends on routing for the second. The endpoint scores well on the fifth for prompts and poorly on the second. Segmentation scores well on east-west visibility and poorly on the fifth. The network path scores well on the second, third, and fourth, and its coverage of the first depends on how the gateways are deployed, so check that one.

What Destination Control Does Not Solve

A prompt injection that steers an agent toward a destination it is allowed to reach will succeed, and the connection will be correctly permitted. A bad decision made entirely inside permitted boundaries is not a network event. Data sent to a model provider you have approved is still data sent to a model provider. Those risks need identity limits, input validation, human approval on sensitive actions, and monitoring inside the agent.

Destination control sits underneath them. It is the layer that still holds when the layers above it fail.

To see where you stand, pull one month of outbound connections from your agent workloads and mark each destination as approved or not. Every destination you cannot mark is the size of your gap, and it is also the list your first allow-rule should be built from.

References

Akamai, "Mapping Today's Nonhuman Interactions Requires a Better Radar." October 22, 2026. https://www.akamai.com/blog/security/mapping-todays-nonhuman-interactions-requires-better-radar

Aviatrix, "AI Agent Guardrails Answer What, Not Where." October 15, 2026. https://aviatrix.ai/blog/ai-agent-guardrails-third-question/

Aviatrix, "Aviatrix Operationalizes the Containment Era with the Industry's First Containment Platform for AI Agents." April 29, 2026. https://aviatrix.ai/newsroom/press-release/containment-platform-for-ai-agents/

Aviatrix, "NVIDIA OpenShell Security Moves Enforcement Off the Host. What Does That Job Without a DPU?" November 3, 2026. https://aviatrix.ai/blog/nvidia-openshell-security-without-a-dpu/

CrowdStrike, "CrowdStrike and NVIDIA Expand AI Agent Security from Software to Silicon." Business Wire, October 21, 2026. https://ir.crowdstrike.com/node/17861/pdf

CrowdStrike, "Why Organizations Secure AI Agents with Falcon Guardian." October 23, 2026. https://www.crowdstrike.com/en-us/blog/why-organizations-secure-ai-agents-with-falcon-guardian/

Illumio, "70% of Organizations Now Delegate Human Decisions to AI, but Half Cannot Fully Audit What It Does." October 21, 2026. https://www.illumio.com/news/70-of-organizations-now-delegate-human-decisions-to-ai-but-half-cannot-fully-audit-what-it-does

Palo Alto Networks, "Advancing Agentic AI Security with Palo Alto Networks and NVIDIA." October 21, 2026. https://www.paloaltonetworks.com/blog/2026/10/advancing-agentic-ai-security-with-palo-alto-networks-and-nvidia/

Palo Alto Networks, "Introducing Cortex XDR 6.0: Built for Endpoints. Ready for Agents." October 19, 2026. https://www.paloaltonetworks.com/blog/security-operations/cortex-xdr-6-0/

Palo Alto Networks, "Palo Alto Networks Brings Continuous AI Defense and Prisma AIRS to the OpenAI Marketplace." October 23, 2026. https://www.paloaltonetworks.com/blog/2026/10/palo-alto-networks-brings-continuous-ai-defense-and-prisma-airs-to-the-openai-marketplace/

Palo Alto Networks Unit 42, "AI-Powered Espionage Campaign Targets Government Linux Infrastructure." October 15, 2026. https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/

Palo Alto Networks Unit 42, "'Next Exploit Opportunities': How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities." October 21, 2026. https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/

Zscaler, "CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks." ThreatLabz, October 21, 2026. https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce

Zscaler, "Putting Boundaries Around Agents: Zscaler Supports NVIDIA OpenShell Reference Architecture for Safe AI Agents." October 21, 2026. https://ir.zscaler.com/news-releases/news-release-details/putting-boundaries-around-agents-zscaler-supports-nvidia