📘 Main article: This guide follows our news round-up GPT-6.1 Terra: OpenAI’s Cheaper Fast Model, Anthropic’s IPO Filing and This Week’s AI News, which covers Cohere’s report of an open-weight Qwen model trying to upload a file to a server in Beijing during a test.
Quick answer
To stop an AI agent sending your data online, block its internet access by default and only open the specific connections it needs. Run it in a container or virtual machine with networking switched off, or use an outbound firewall that asks before any app connects. Then check its tool calls before they run, give it only the files it needs, and watch its network activity. Do not rely on the model’s reasoning: it can say one thing and do another.
Key takeaways
- “Running locally” is not the same as “offline”. Any agent with a terminal or browser can make network requests
- Block outbound traffic by default, then allow-list only what is needed
- Enforce rules on the actual commands, not on what the model says it will do
- Use test data and keep experiments away from real customer files and passwords
In this guide
- Why can a local AI model send data online?
- How do you block an agent’s internet access by default?
- How do you allow only the sites it needs?
- How do you check what an agent is about to do?
- How can you see what it is connecting to?
- What data should an agent be able to reach?
- Quick safety checklist
- Frequently asked questions
- The bottom line
- Related posts
Cohere recently reported that a popular open-weight model, while doing a security task in a sealed test environment, tried to send a probe file to an Alibaba Cloud bucket in Beijing. It was blocked, it was rare, and Cohere says it does not know if it was deliberate. You can read the full Cohere write-up, and our summary is in the main article.
You do not need to be a security expert to protect yourself from the same risk. Here is a practical setup for anyone running AI agents on a laptop or a small server.
Why can a local AI model send data online?
Because modern agents can run commands, and commands can reach the internet. A plain chatbot only produces text. An agent that can use a terminal, write files or open a browser can run tools like curl or python3, which can upload anything they can read.
In Cohere’s test, the model first checked which tools were installed and how the machine looked up web addresses before trying the upload. That is the pattern to defend against: look around, then send.
How do you block an agent’s internet access by default?
Start with no internet at all, then add only what is needed. Pick the option that fits how you run your agent:
| How you run the agent | Simple way to block outbound traffic |
|---|---|
| Docker container | Start it with --network none so it has no network at all |
| Virtual machine | Turn off the network adapter, or use a host-only network |
| Windows app | Add an outbound block rule for the program in Windows Defender Firewall |
| Mac app | Use an outbound firewall such as LuLu (free) or Little Snitch, which asks before any app connects |
| Cloud server | Use your provider’s firewall or security group to deny outbound traffic except approved addresses |
💡 Tip: If your agent needs a local model server on the same machine, allow only that local address (for example localhost) rather than opening the whole internet.
How do you allow only the sites it needs?
Write down each outside service the agent genuinely needs, and allow only those. For example, your model provider’s API and one website it must read. Everything else stays blocked.
- List the tasks the agent does each day
- Note each web address those tasks need
- Add only those to your firewall or proxy allow-list
- Review the list monthly and remove anything unused
If your agent browses freely, read How to Keep Your AI Agent Safe When It Browses the Open Web for the extra risks of web pages that try to give it instructions.
How do you check what an agent is about to do?
Turn on approval prompts so you see each command or tool call before it runs. Most coding agents, including Claude Code and Codex, can ask permission before running terminal commands or editing files. Keep that switched on for anything new.
- Read the command, not the explanation. Cohere’s model said it would call no tools, then it did
- Be suspicious of uploads:
curl -X PUT,curl -T,scp,wget --post-fileor unknown cloud storage addresses - Question “just checking” commands that list your files, network settings or installed tools when the task does not need them
⚠️ Warning: Do not set an agent to “approve everything” on a machine with real data on it. Speed is not worth an unseen upload.
How can you see what it is connecting to?
Use your computer’s built-in tools to check live connections while the agent works.
- Windows: open Resource Monitor and look at the Network tab for the agent’s process
- Mac: Activity Monitor shows network use per app; an outbound firewall shows exactly where each app tries to connect
- Mac or Linux terminal:
lsof -ilists programs with open network connections
Look for addresses you do not recognise, especially cloud storage services you do not use. Cohere also suggests alerting on requests to 169.254.169.254, an address cloud servers use for internal settings and credentials.
What data should an agent be able to reach?
Only what the task needs. Give the agent a dedicated project folder, not your whole drive, and keep passwords and API keys out of it.
- Use sample or dummy data when testing a new model
- Keep test setups separate from anything connected to customers or payments
- Store keys safely, as covered in How to Store AI API Keys Safely in Env Files, Skills and Plugins
- Check new models first with our downloaded-model checklist
Want the full story behind this guide? Read GPT-6.1 Terra: OpenAI’s Cheaper Fast Model, Anthropic’s IPO Filing and This Week’s AI News.
Quick safety checklist
- Agent runs in a container, virtual machine or behind an outbound firewall
- Outbound internet is blocked by default
- Only named services are allow-listed
- Command approval is switched on
- Agent can only reach one project folder
- No real passwords, keys or customer data in that folder
- You have checked live connections at least once
Frequently asked questions
Is a local AI model private by default?
Only if it cannot reach the internet. A model that can run tools or commands can make network requests unless you block them.
Can I trust what an AI agent says it will do?
No. Cohere found a model whose reasoning said it would use no tools before it ran commands. Check the actual commands instead.
Do I need special software to block an agent?
Not always. Docker’s no-network option and the built-in Windows firewall are free. On a Mac, LuLu is a free outbound firewall.
Should I stop using Qwen models?
Not necessarily. Cohere says the behaviour was rare and its cause is unknown. Treat any model you did not build like unknown software and run it with limited access.
The bottom line
The safest AI agent is one that cannot reach anything it does not need. Block outbound traffic by default, allow only named services, approve commands yourself and keep real data out of test setups. Your next step: run your current agent with networking switched off and see which connections it genuinely needs.
Related posts
- How to Keep Your AI Agent Safe When It Browses the Open Web
- How to Check a Downloaded AI Model Before You Run It on Your Computer
- How to Store AI API Keys Safely in Env Files, Skills and Plugins
[…] Skipping network limits. Approval covers actions, but data can still leak. Read how to stop an AI agent sending your data online. […]