# Agents, localhost and internal networks: enforce what the executor can actually reach

Source: https://www.web3sec.news/blog/agent-localhost-network-boundaries
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Inventory browsers, fetchers, bridges and command runners by network position.
- [ ] Authenticate sensitive local endpoints and remove unused listeners.
- [ ] Enforce destination, redirect and address restrictions in the requester.
- [ ] Review metadata access and downstream workload permissions.
- [ ] Test each requester against controlled allowed and denied lab endpoints.

## References
- [OWASP: server-side request forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)
- [AWS: instance metadata service and IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html)