Confused Deputies in Production AI Agents: Network Self-Disclosure and Redirect Boundaries

Abstract Large language model assistants increasingly ship a tool that lets the model fetch URLs on its own. This reopens a server-side request forgery (SSRF) problem long known from web applications, now spread across vendors with their own fetch implementations and filtering. We ran two probes against fourteen production AI products: six from major labs and eight smaller or self-hosted agents. Probe 1, run five times against every product, needs no exploit: a plain request to public self-report services asking each product to report its own outbound fingerprint. All six major-lab products complied, five in full and one partially, and the addresses they disclosed appeared to belong to sandbox or VPS providers rather than to the AI vendors. Among the smaller agents, behavior ranged from honest refusal to full disclosure to fabrication of IP data with no real request made. Probe 2 tested redirects into reserved address space. A benign control redirect was followed by all fourteen products; the metadata redirect, run against the six named products and one disclosed agent, was declined by every named product with a message naming the destination. That points to a judgment about the destination rather than to a network control. One smaller agent, tested under an existing authorized relationship, was reachable into its vendor's internal network.