Guides · ← All guides · Reviewed November 2026 · 6 min read
What Is Egress in AI Evaluation?
Egress defined for eval environments: all-interface binds, 0.0.0.0/0 ingress, public buckets — and the credentials that turn reach into exfiltration.
The short answer: in AI evaluation, egress is the network reach of the eval environment — the paths data can leave by, and the paths the environment itself can be reached on. An eval harness bound to all interfaces, an ingress rule open to 0.0.0.0/0, or a public results bucket gives the eval agent, and anyone who reaches it, a working channel to real data. EvalEgress flags exactly those declarations as open_binding, open_ingress and public_bucket_acl findings (reviewed November 2026). Check yours with the free scan.
Why is egress an eval problem specifically?
Eval environments hold unusually valuable traffic. Prompts and responses include real data samples — that is what makes the eval meaningful. The harness also executes: it calls tools, fetches URLs found in eval data, and writes results somewhere. Three ordinary declarations turn that into egress exposure:
- The harness listens too widely. A dev server or results viewer bound to all interfaces is reachable by the whole network, not just the team.
- The firewall defaults to open. A 0.0.0.0/0 ingress rule copied from a tutorial makes the eval box a public endpoint.
- Results land in public storage. A public-read bucket of eval outputs is a published archive of prompts, responses and whatever data they carried.
And eval data is adversarial by design: test sets include prompt-injection cases. An agent that can be steered by its input, holding network reach and data access, is an exfiltration path with the instructions built into the test file. The full boundary picture is in what is eval-to-production exposure?
The network exposure classes EvalEgress checks
| Class | Severity | What it means |
|---|---|---|
open_ingress | HIGH | 0.0.0.0/0 ingress — restrict to who needs it. |
public_bucket_acl | HIGH | Public-read storage — restrict to who needs it. |
open_binding | MEDIUM | All-interface binds — bind eval services to localhost or the private network instead. |
Severity follows the platform's scoring (HIGH 15, MEDIUM 8) — the classes are declared-surface facts, read from the files you paste, never probed live. The method is documented on /docs.
Egress plus credentials is the real risk
Network reach alone moves nothing — there has to be something worth moving and a way to move it. That is why the same scan checks the credential classes (aws_access_key_id, private_key_block, generic_api_key and the rest of the 16): reach plus a live credential plus a steerable agent is the complete path. Closing any one side breaks it; the scan exists so you can see both sides in one report instead of auditing network and secrets in separate passes that never meet.
How do you close eval egress?
Bind eval services to localhost or the private network, never all interfaces. Restrict ingress to the addresses that actually run evals. Make results storage private by default and share exports deliberately. Then prove it in the files: paste the declared configs into the free exposure scan and keep the report with the eval run. The ordered version of this is the pre-deployment eval safety checklist. EvalEgress is one of the Ingenious AI platforms.
Frequently asked questions
What is egress in AI evaluation?
The network reach of the eval environment: the paths data can leave by, and the paths the environment can be reached on — its service bindings, its ingress rules, and the storage its results land in.
Is ingress the same as egress?
No — they are opposite directions, and both expose an eval environment. Ingress decides who can reach in and steer or read the harness; egress decides where data can be sent. EvalEgress flags both, because a steered agent plus an open path out is the complete problem.
What does an open binding mean?
The service listens on all network interfaces (0.0.0.0) instead of just localhost or a private interface, so anything that can route to the machine can reach the eval harness or its results viewer.
Can an eval agent really exfiltrate data?
It needs three things at once: access to real data, network reach, and input that steers it — and eval test sets deliberately include steering inputs, such as prompt-injection cases. Removing any one of the three breaks the path; the scan shows you the first two in your declared files.
Does EvalEgress probe my live network?
No. It reads the files and configs you paste — declared surfaces only. It finds exposure in those declarations; it never touches live systems and never proves exploitability.