SSRF Internal Network and Private IP Range Access
An AI agent with a tool that fetches URLs can be pointed at internal IP addresses or internal hostnames instead of public websites. This lets an outside attacker use the agent as a proxy to reach systems that are normally shielded from the internet.
How the attack works
An attacker supplies or manipulates a URL the agent's HTTP-fetch tool will retrieve, targeting private IP ranges (192.168.x.x, 10.x.x.x, 172.16–31.x.x) or internal-looking hostnames like internal.* or admin.internal. The agent, running inside the trusted network, makes the request on the attacker's behalf. If the target is an admin panel, internal API, microservice, or cloud metadata/management endpoint, the response can reveal data or functionality that should never be exposed externally. This gives the attacker a foothold to explore or interact with internal infrastructure without direct network access.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 78f4d4ec-20d0-435f-ab83-da5e64f13ceb
- Severity
- High
Why it matters
An organization can lose confidentiality of internal systems and data, and an external attacker gains an indirect path into the internal network via the agent's fetch capability. This is one step of a larger attack (reconnaissance or access), not full compromise by itself.
What you can do
- →Restrict the agent's HTTP-fetch tool with an allowlist of approved external domains and block resolution to private IP ranges and internal hostnames.
- →Validate and re-resolve URLs at fetch time to block DNS rebinding to internal addresses.
- →Run the fetch tool from a network segment with no route to sensitive internal services, or place a proxy in front of it that enforces the block.
- →Review logs for fetch requests targeting RFC-1918 addresses or internal-looking hostnames, and confirm any such traffic against the known-authorized use cases before treating it as normal.
Known benign look-alikes
- Agents operating within a private network explicitly authorized to query internal services
- Network monitoring agents with approved internal scan permissions