The URL is an output channel

A URL looks like an invitation to move somewhere else. In an agent system, it can also be a package sent outward. A path, query string, fragment, or subdomain may contain the name of a customer, a private search, a document excerpt, an internal identifier, or a token copied from the working context. The browser has not opened the link. No request appears to have been made. Yet the string itself may already have crossed a boundary when it is rendered, logged, previewed, indexed, or passed to another service.

That is the important lesson in OpenAI’s 2026 account of AI agent link safety. The obvious security story says a malicious page might hurt the user after a click. The less obvious story begins earlier: an attacker can induce an agent to construct a URL that encodes sensitive information and points toward an external destination. If an independent service can observe or index that address, disclosure can occur even when the user never follows it.

This is not a strange corner of web security. It is a reminder that agent outputs are active objects. Systems routinely treat generated prose as low-risk and tool calls as high-risk. URLs occupy the uncomfortable middle. They are text with executable consequences, and sometimes the consequence belongs to the act of composition rather than the act of navigation.

The leak can happen before the click

Traditional link safety concentrates on destination reputation, redirects, phishing, downloads, and browser isolation. Those controls remain necessary. They do not answer whether the address itself should have been produced. A perfectly reputable analytics service can receive a perfectly dangerous query parameter if an agent has filled it with private material. Destination safety and payload safety are separate questions.

The distinction becomes sharper when agents read untrusted content. NIST’s agent-hijacking evaluation work describes the underlying indirect-injection risk: hostile instructions embedded in data an agent ingests can induce unintended actions. A document can ask the agent to summarize a file, place the summary in a search query, and cite the resulting address. The model may believe it is satisfying a research request. The attacker sees an encoding mechanism. The user sees a helpful link.

A generated link is not merely a route to information; it may be the route by which information leaves.

The right control point is therefore URL construction, not only URL opening. Before a generated address is displayed, fetched, shortened, previewed, or sent to another system, the application should ask what data it contains, who controls the destination, whether the destination was independently requested, and whether the address can be reduced to a known-safe form. A warning shown after the full secret has been placed in the URL is a warning delivered too late.

This changes how allowlists should be understood. An approved domain is not a blanket approval for every path and parameter. The policy may need to distinguish a fixed documentation link from an agent-authored request to the same host. It may permit public identifiers but reject strings derived from private context. It may remove fragments, limit query length, or require that the destination template be supplied by the application rather than invented by the model.

Treat composition as an action

Security architecture often separates reading from writing. The agent can read broadly, but a write requires stronger authority. URL generation shows why that binary is too coarse. Some text is inert. Some text addresses another system. Some text causes a client, crawler, logging pipeline, or preview service to communicate. A useful classification asks whether an output creates an externally observable reference, not merely whether the agent invoked a tool.

The user interface should preserve that distinction. A system can render an unverified address as plain text rather than a live link, redact suspicious parameters, show the destination and the data-bearing portion separately, or require confirmation when a link was derived from sensitive material. These are not cosmetic choices. They give the user a chance to see the transfer the agent is proposing.

The same principle belongs in testing. A test suite should seed private canary values into documents and prompts, expose the agent to instructions that request link construction, and check every surface where a URL might appear. That includes citations, markdown, image sources, webhooks, redirects, browser previews, telemetry, and error messages. A test that only watches network calls will miss disclosure embedded in output that another component later resolves.

Logs need care as well. Recording the full generated URL can turn the security control into a second copy of the leak. Detection can preserve a hash, destination class, parameter names, policy result, and redacted excerpt without retaining the sensitive value. Reviewers need evidence that the system blocked a transfer; they rarely need the secret repeated verbatim in a searchable event stream.

Output deserves an egress policy

The broader design lesson is to apply data-loss thinking to generated artifacts. Links, filenames, QR codes, image requests, citation metadata, and even structured error messages can all carry material out of the trust zone. If an agent can assemble them from protected context, the output boundary must understand both the source of the data and the semantics of the container.

This does not require treating every hyperlink as hostile. It requires refusing the comforting fiction that text cannot act. The application can prefer fixed links over model-composed ones, constrain destinations by task, remove unnecessary parameters, scan values derived from secrets, and preserve a reviewable reason whenever the system allows an exception. Defense in depth begins by naming the actual channel.

The web taught people to inspect where a link goes before they click. Agents add an earlier question: how did the link come to contain what it contains? That question belongs at generation time. By the time the address is clickable, the most important boundary may already have been crossed.

— Dispatches · Summit Cognitive