How do I isolate an AI agent with network segmentation and egress controls?

To isolate an AI agent using network segmentation and egress controls, implement sandboxing with network policy controls and controlled egress paths, and ensure continuous discovery and monitoring of agent network traffic.

• Implement Sandboxing with Network Policy Controls and Controlled Egress Paths: Utilize kernel-level isolation technologies, such as NVIDIA OpenShell, which provide namespace-based isolation, Landlock filesystem restrictions, seccomp syscall filtering, and network policy controls with controlled egress paths. This aligns with the NIST AI RMF's Protect function by hardening the runtime environment and preventing unauthorized network access.
• Monitor LLM API Traffic for Egress Control: Baseline and fingerprint LLM API traffic patterns, including characteristic request sizes, response cadences, and endpoint fingerprints, to identify AI agents making outbound calls to LLM providers like api.anthropic.com or api.openai.com. This helps in detecting unauthorized data exfiltration, addressing OWASP LLM Top 10 risk LLM05: Supply Chain Vulnerabilities by monitoring external dependencies and LLM06: Sensitive Information Disclosure by identifying potential data leaks.
• Deploy Container-Native Monitoring for Isolated Environments: For agents running within containers (e.g., Docker, Kubernetes pods, GitHub Codespaces), deploy lightweight discovery agents *inside* the containers at startup to enumerate running processes, loaded MCP servers, active LLM connections, and configured tool sets. This is crucial because host-level monitoring tools often cannot observe processes within isolated container environments, which is a blind spot for traditional security tools. This supports the NIST AI RMF's Detect function by providing visibility into otherwise invisible shadow agents.
• Address MCP Server Egress: Recognize that MCP (Multi-Capability Platform) servers, even within sandboxed environments, can punch through isolation boundaries by design to interact with external systems (e.g., GitHub, memory, file systems, web browsers). While the sources do not explicitly detail specific network segmentation or egress controls for MCP servers, they highlight the need to understand and manage the external reach these servers provide.