{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/openai-safe-url-exfiltration-defense-2026/",
 "asOf": "2026-09-26",
 "id": "openai-safe-url-exfiltration-defense-2026",
 "date": "2026-01-28",
 "datePrecision": "day",
 "title": "OpenAI describes Safe Url check that only auto-fetches URLs already seen publicly to block exfiltration",
 "lane": "defense",
 "kind": "tool-release",
 "summary": "OpenAI explains that an injected agent can leak data by requesting an attacker URL that embeds private information, and argues that domain allow-lists are insufficient because trusted sites can redirect and strict lists cause warning fatigue. Its safeguard only lets the agent fetch a URL automatically if an independent crawler has already seen that exact URL on the public web; otherwise it warns the user or tells the agent to use another source. A March 2026 post names the mechanism Safe Url and places it within a social-engineering view of prompt injection and source-sink analysis.",
 "whyItMatters": "It is a deterministic control on one exfiltration sink that works even when the model is fooled.",
 "actors": [
  "openai"
 ],
 "topics": [
  "data-exfiltration",
  "prompt-injection"
 ],
 "atlas": [
  "tools",
  "untrusted-content",
  "human-approver"
 ],
 "artifacts": [],
 "sources": [
  {
   "url": "https://openai.com/index/ai-agent-link-safety/",
   "publisher": "OpenAI",
   "title": "Keeping your data safe when an AI agent clicks a link",
   "date": "2026-01-28",
   "type": "primary",
   "accessed": "2026-09-25"
  },
  {
   "url": "https://openai.com/index/designing-agents-to-resist-prompt-injection/",
   "publisher": "OpenAI",
   "title": "Designing AI agents to resist prompt injection",
   "date": "2026-03-11",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "Automatic fetches are allowed only for URLs previously observed by an independent web index with no access to user conversations; unverified URLs trigger a warning or redirection to another source.",
   "locator": "Our approach section"
  },
  {
   "fact": "OpenAI says the safeguard does not guarantee page content is trustworthy or prevent social engineering; it is one defense-in-depth layer.",
   "locator": "What this protects against section"
  },
  {
   "fact": "The March 2026 post states that effective real-world injections increasingly resemble social engineering and that AI firewall classifiers usually miss them; the same mechanism applies to Atlas navigation and Deep Research.",
   "locator": "Designing agents post, sections on social engineering and ChatGPT defenses"
  }
 ],
 "significance": 3,
 "fideQuestions": [
  "FID-076"
 ],
 "methods": [
  "agent-data-exfiltration",
  "capability-restriction",
  "indirect-prompt-injection",
  "injection-classifiers"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}