Browsing tool without URL allowlist

An agent browsing / HTTP-fetch tool has no URL/host allowlist and no declared SSRF protection. The model can steer the tool to reach any host — cloud instance-metadata endpoints (169.254.169.254, metadata.google.internal, …), private networks, localhost services — a server-side request forgery surface.

Reaching a metadata endpoint returns the instance’s credentials, so this is a direct path to credential theft and lateral movement into the cloud account — hence Critical. When the code names a metadata/IMDS host explicitly, the finding fires even if an allowlist is present (an allowlist that does not exclude the metadata endpoint offers no protection), and the finding carries a metadata_endpoint property.

This is the configuration framing (no allowlist) and is deliberately not deduplicated against the LLM05 browsing-tool-returns-raw-content (the content-flow framing): both may fire on the same tool and reference each other. A tool with an allowlist that does not reach a metadata endpoint is not flagged.

Configuring allowed_hosts / url_allowlist produces no finding.