Network Pivot Attack

Sandbox

A tool is granted access to one internal API. A compromised tool uses that legitimate outbound path to pivot: it reaches billing, a secrets vault, and an attacker-controlled exfiltration server. MPP's WASI network filter blocks every connection to an undeclared domain.

Declared capability

"network": ["hr-api.internal"]

The tool declares access to one host. At runtime, it attempts four.

Without MPP

With MPP

Declared targetdeclared

hr-api.internal

Internal billing service

billing.internal

Internal secrets vault

secrets.internal

Attacker-controlled server

exfil.attacker.io

WASI socket interception

MPP's network filter wraps Wasmtime's WASI socket implementation. Before any TCP connection is established, the filter checks the target hostname against the capability token's allowed_network_domains. A domain not in the list causes the socket call to return ECONNREFUSED without making any OS-level connection attempt — DNS resolution never occurs.

Get started free More demos