Keeping Your Data Safe When an AI Agent Clicks a Link

Core Security Architecture

OpenAI deploys end-to-end link safety policies within its agent capabilities—such as the Assistants API and GPT-4-turbo–driven automation workflows—to mitigate two critical threats: (1) data exfiltration via malicious URLs, and (2) prompt injection triggered by redirects or response payloads.

Key Technical Safeguards

• Sandboxed Network Request Execution: All HTTP(S) requests initiated by AI agents run in an isolated sandbox environment that prohibits access to user session context, raw prompts, API keys, or local credentials; responses undergo structured parsing before limited injection into the LLM context.
• Dynamic URL Allowlisting: External link access is disabled by default; only domains explicitly declared in allowed_domains (supporting wildcards and regex, e.g., api.example.com, *.stripe.com) are permitted—subject to enable_url_access being enabled; unmatched domains are blocked and logged for audit.
• Response Content Sanitization & Context Injection Filtering: Returned HTML/JSON/Text payloads undergo mandatory content-type detection and heuristic scanning for injection vectors (e.g., <script>, {"prompt":"..."}, base64-encoded command sequences); payloads containing such patterns are discarded before entering the LLM context.

Operational Constraints & Scope

• These protections apply exclusively to OpenAI’s native agent runtime (i.e., Assistants API v2 and GPT-4-turbo with tools), not to custom function calls invoking external requests libraries;
• All safeguards are enforced server-side; no client-side SDK configuration is required beyond using openai>=1.35.0, enabling tool_choice="auto", and declaring tools of type "code_interpreter" or "function";
• Efficacy has been validated in internal red-team testing: 100% interception rate against variants of the ‘Link-Based Prompt Injection’ attack described in arXiv:2402.13528.