AI Agents Will Curl Your Localhost

AI models know that 169.254.169.254 returns cloud metadata. They know localhost:6443 is where Kubernetes lives. They know 10.0.0.0/8 is private network space. When you give them agent tasks involving network access, they will target these endpoints. Not maliciously. Just competently.

The model knows too much

Large language models are trained on infrastructure documentation, DevOps guides, and security research. They know the internal topology of cloud environments. They know the standard ports for every major service. They know the IP ranges reserved for private networks.

This knowledge is useful when a human is asking questions. It's dangerous when an autonomous agent is generating commands to execute.

What this looks like

None of these are jailbreaks. The model isn't being tricked. It's generating the commands it was trained to know about for the task it was given. The problem is that "useful knowledge" and "dangerous target" overlap completely in infrastructure contexts.

The more autonomous, the more dangerous

If a human approves every command, the human is the gate. They see 169.254.169.254 and reject it. But the trend in AI coding tools is toward more autonomy — agents that run commands without human review. The more autonomous the agent, the more you need an automated gate.

The fix: validate commands before execution

Check validates every command before it reaches the shell. Commands targeting localhost, private IP ranges, cloud metadata endpoints, and internal services are blocked automatically.