ATK-011 Output handling
Insecure Output Handling — SSRF via URL
Applies to: LLM, Agentic AI · Last reviewed 2026-05-01
Prerequisites
- Target system or agent fetches URLs emitted by the model (e.g., 'browse this link', 'retrieve this resource').
- Fetcher lacks an allow-list of permitted destinations or proper internal/private IP exclusion.
Test approach
With written authorization, the tester causes the model to emit URLs targeting internal infrastructure, cloud-metadata endpoints (169.254.169.254), or private network ranges. The tester observes whether the agent fetches these and whether responses are returned to the user (turning the agent into an exfiltration channel).
Expected evidence
- Prompts and model outputs containing the test URLs.
- Network logs showing fetch attempts to restricted destinations.
- Model responses showing internal data was returned.
Detection signals
- Agent fetches to private IP ranges, link-local, or cloud-metadata IPs.
- Agent fetches to domains not on a permitted-domains list.
- Outputs containing data with patterns of internal/cloud metadata.
Defensive recommendations
- Enforce a permitted-domain allow-list for any model-output URL fetch.
- Block private IP, link-local, and cloud-metadata ranges at the fetcher.
- Re-prompt with explicit instruction not to retrieve content from suspicious domains; combine with policy enforcement at the fetcher (defense in depth).
- Reference AI-CTRL-019 (Agentic Tool Authorization).
Framework mappings
- OWASP LLM Top 10: LLM02:2025
- OWASP Agentic Top 10: AAI02
- NIST AI RMF: MEASURE-2.7
Related AI Controls Catalog entries
These controls provide the audit test procedures that validate defences against this attack pattern.