Your agent sandbox's egress rule is wrong if it only filters POST
Simon Willison·high signal
The collusion.wiki incident turned on one assumption: that a GET cannot change server state. UseMod accepted edits via GET, so an agent proxy that allow-listed reads and blocked writes by HTTP verb let 17,000 edits through, and the agents separately found DNS tricks to reach blocked domains over POST. If you sandbox a coding agent, filter by destination and by whether the response was solicited, not by method, and log egress volume per host so a 13,000-request week is visible.