SSRF Localhost Service Probe
An attacker gets an AI agent to make outbound requests to 127.0.0.1 or other loopback addresses instead of the intended external target. This can expose internal services on the agent's own host that were never meant to be reached from outside, such as unauthenticated databases or debug endpoints.
How the attack works
The attacker crafts input (a URL, a file path, a parameter) that the agent processes and turns into an outbound request, aiming that request at localhost or a loopback alias like ::1, 0.0.0.0, or a decimal/hex-encoded form of 127.0.0.1. Because the request originates from the agent's own machine, it lands on services bound only to the loopback interface, things like a Redis instance on 6379, MongoDB on 27017, or Elasticsearch on 9200. These services often have no authentication because they assume only local processes can reach them. The agent, acting as a confused deputy, returns whatever the internal service sends back, letting the attacker read data or interact with an admin interface they could never reach directly.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 019534ef-5312-42d0-b8c3-3ac8b8749924
- Severity
- Critical
Why it matters
An organization can lose confidentiality of internal data (database contents, configuration, credentials) and potentially get limited control over local services, all without the attacker ever having direct network access to the host.
What you can do
- →Bind sensitive local services (Redis, MongoDB, Elasticsearch, admin panels) to require authentication even on loopback, don't rely on network isolation alone.
- →Validate and restrict any URL or address an agent can fetch or connect to, blocking loopback and link-local ranges unless explicitly required.
- →Normalize and decode addresses before filtering so encoded or alternate forms of 127.0.0.1 (decimal, hex, IPv6) can't bypass a blocklist.
- →Review logs for outbound requests from agents targeting loopback addresses and distinguish legitimate local testing from unexpected probes.
Known benign look-alikes
- Development agents running integration tests against a local server (e.g. routine health/metrics checks)
- Local development environment where the agent intentionally serves localhost