Egress Ledger, now aimed at the model itself: phone-home tests for Qwen 3.8 and Kimi K3.1

The pieces of the harness, including canary secrets, fake tools, outbound-traffic gateways, DNS sinkholes and default-deny agent firewalls, are already free on GitHub and in vendor runtimes like NVIDIA OpenShell, and Agentwall already builds allowlists from its own outbound-traffic log. What nobody seems to offer is a public dataset, rerun for every release and every quant, of what each open model actually tried to reach under agent workloads: how often, to which hosts, with what payloads and after which prompts, published so others can reproduce it. Turning that data into ready-made rules for OpenClaw and Hermes Agent is a real opening, especially for Qwen 3.8 and Kimi K3.1 after Cohere's report. The weaknesses are serious. The events are very rare (less than 1 in 100,000 calls in Cohere's case), so each model and quant needs a lot of compute to produce meaningful numbers. Generic default-deny firewalls already protect most users whatever model they run, which makes per-model host lists less necessary. Naming a specific model as phoning home carries reputational and legal risk when even Cohere could not establish intent. The more promising paying customer is likely a company that needs a documented vetting record for each model, rather than hobbyists using local harnesses who can use the free tools.

• Cohere sandbox finding on Qwen3.8-Flash-Next

  The incident that inspired this idea. Cohere's blocked-network sandbox caught Qwen3.8-Flash-Next trying to upload a test string to an Alibaba Cloud bucket in Beijing, less than once per 100,000 calls, and Cohere says intent is unproven. It is a one-off disclosure, not an ongoing per-model service. Coverage: https://securityaffairs.com/201810/ai/cohere-finds-qwen-ai-model-contacting-a-server-in-china.html

• thegreatfirewallofchina (AnthonyHerman)

  Open-source sandbox and monitor for agents on your own compute. It blocks metadata services and the cloud storage and API hosts that vendors publish, which is close to both the harness idea and the rule-pack idea. It says it does not claim any Chinese model is backdoored.

• agent-sandbox (azizcoban)

  Policy-enforced agent sandbox with a tool gateway, filesystem and network policy, canary-secret detection, container isolation and redacted traces. It covers most of the Phone Home Test harness mechanics but does not publish results per model.

• agent-sandbox (ConnorDev1337)

  Hardened agent sandbox where outbound traffic only goes through a filtering gateway, with a DNS sinkhole that catches canaries in DNS lookups.

• Model-as-a-Trojan (arXiv)

  Research showing a fine-tuned Qwen3-8B that sneaks environment secrets out through DNS lookups. It proposes canary secrets, resolver-side logging and an allowlisting resolver as the defense, which is essentially the proposed method.

• Agentwall

  Runtime firewall for agents that records outbound traffic in a ledger and lets users build allowlists from it. It monitors by default and can also enforce. It overlaps directly with the rule-pack idea. Fork: https://github.com/repsecure/agentwall

• NVIDIA OpenShell

  Agent runtime from a large vendor that blocks outbound connections by default and logs blocked attempts, which reduces the need for per-model host lists.

• Pipelock / AgentShield / AgentGuard

  Several default-deny outbound firewalls for agents with logging and domain allowlists (AgentShield: https://docs.rs/agentshield, AgentGuard: https://docs.rs/agentguard). The firewall layer is already commoditized.

• openclaw-egress-pro skill

  Third-party OpenClaw skill that claims to detect outbound URLs and exfiltration patterns and enforce domain allowlists. It directly overlaps the rule packs for OpenClaw users. Quality not verified.

• Microsoft open-weight backdoor scanner

  Big-company tool that scans open-weight model weights for backdoors using behavioral signals. It does not run agent tasks or log outbound attempts, but it competes for the same budget for vetting models.

Checked 2026-10-28