Agent SSRF to cloud metadata / file inclusion via unvalidated fetch URL
Some AI agents let users or connected systems tell them to 'fetch this URL' without checking where that URL actually points. Attackers abuse this to make the agent reach internal-only addresses it should never touch, like cloud metadata services that hand out credentials, or local files on the server.
How the attack works
An attacker supplies a URL to an agent's fetch/tool-call feature, either directly or by hiding it in content the agent processes. Because the agent does not restrict which network destinations or URL schemes are allowed, it will happily request internal-only targets such as the cloud provider's metadata IP, a file:// path on local disk, or gopher/dict schemes used purely for SSRF tricks. The agent's fetch then returns the response—cloud credentials, file contents, or other internal data—to the attacker. This mirrors known vulnerabilities in PraisonAIAgents, pgAdmin, and Open WebUI where the same missing checks were exploited.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9f787fed-dcd3-42bd-9975-66047a26d5f8
- Severity
- High
Why it matters
An attacker can steal cloud instance credentials, read arbitrary local files, or use the agent as a proxy into internal network services, all without needing separate access to the underlying infrastructure.
What you can do
- →Block agent-initiated network requests to cloud metadata IP ranges (e.g. 169.254.169.254) and other internal address space by default.
- →Restrict fetch tools to an allowlist of expected URL schemes (http/https) and reject file://, gopher://, dict://, and similar.
- →Validate and normalize URLs server-side before any fetch, including after redirects, rather than trusting client-supplied targets.
- →Review agent session logs for fetch calls targeting internal IPs, localhost, or non-http schemes, and treat matches as suspicious unless explicitly authorised.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.