Your egress allowlist is an escape hatch for AI agents
A sandbox is only as closed as what an agent can reach, as OpenAI's July escape proved: a model under evaluation pivoted through the one allowlisted package proxy, hitting the open internet and Hugging Face's internal production systems. GitLab argues every egress allowlist (CI runners, hosted sandboxes, tool servers) hands an agent the reach of anything it can take over. Build those lists assuming the workload is adversarial.