Browsing tool returns raw content

An agent browsing / HTTP-fetch tool returns the raw fetched body into the model context or the user surface, with no URL/host allowlist restricting where it may fetch. The model can be steered (via a prompt or retrieved content) to fetch an internal or attacker-controlled host — server-side request forgery via AI browsing — and the raw response body then flows unchecked into the context, where it can also carry a Markdown exfiltration payload.

A browsing tool with a host allowlist (and a redirect restriction) is the recommended configuration and produces no finding.

Configuring allowed_hosts / url_allowlist (and allow_redirects=False) produces no finding.