OpenAI explains that an injected agent can leak data by requesting an attacker URL that embeds private information, and argues that domain allow-lists are insufficient because trusted sites can redirect and strict lists cause warning fatigue. Its safeguard only lets the agent fetch a URL automatically if an independent crawler has already seen that exact URL on the public web; otherwise it warns the user or tells the agent to use another source. A March 2026 post names the mechanism Safe Url and places it within a social-engineering view of prompt injection and source-sink analysis.
Why it matters
It is a deterministic control on one exfiltration sink that works even when the model is fooled.
Key facts
As stated in the sources, with where to find them.
- Automatic fetches are allowed only for URLs previously observed by an independent web index with no access to user conversations; unverified URLs trigger a warning or redirection to another source.Our approach section
- OpenAI says the safeguard does not guarantee page content is trustworthy or prevent social engineering; it is one defense-in-depth layer.What this protects against section
- The March 2026 post states that effective real-world injections increasingly resemble social engineering and that AI firewall classifiers usually miss them; the same mechanism applies to Atlas navigation and Deep Research.Designing agents post, sections on social engineering and ChatGPT defenses
Findings that cite this record
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.
Sources
Related records
Feb 13, 2026
Aug 6, 2025
Jan 19, 2026
Oct 31, 2025
Oct 8, 2025
Sep 25, 2025