SSRF Beyond HTTP: Egress-Path-Incomplete Guards in AI Agent Platforms

Server-side request forgery defenses in AI agent platforms are built around one egress chokepoint. A hardened HTTP client validates every URL it touches. A platform can validate that client perfectly. It can still ship a second network client (smtplib.SMTP(), a raw socket, an FTP dialer) that opens outbound connections through a call site the blocklist never sees. The guard is not weak. It is incomplete in the egress dimension. We define the Egress-Path-Incomplete (EPI) SSRF class as a coverage defect, P ⊊ E, where E is the set of outbound clients and P the subset on which the guard actually runs. Any client in E \ P is a full-strength SSRF primitive regardless of guard quality. CVE-2026-33234 in AutoGPT (170k+ GitHub stars) is the instance. validate_url_host() governs backend/util/request.py. SendEmailBlock reaches the network through smtplib.SMTP(smtp_server, smtp_port) and calls none of it. A protocol-parser mismatch upgrades the bug from blind to non-blind. smtplib expects a 220 greeting. A non-SMTP service banner (SSH-2.0-OpenSSH_8.9p1 Ubuntu) lands in an SMTPConnectError and echoes to the user. A blind SSRF becomes a non-blind internal port scanner leaking exact version strings at most log2 3 ≈ 1.58 bits of topology per API call. We give the fix (guard the socket, not the URL), note that the shipped 0.6.52 patch re-resolves the hostname at connect and so structurally leaves a DNS-rebinding TOCTOU gap, and describe a dominator-analysis coverage audit that finds the class mechanically.