Server-side request forgery defenses in AI agent platforms are built around one egress chokepoint: a hardened HTTP client that validates every URL it touches. A platform can validate that client perfectly and still ship a second network client, smtplib.SMTP(), a raw socket, an FTP dialer, that opens outbound connections through a call site the blocklist never sees. The guard is not weak. It is incomplete in the egress dimension. We define the Egress-Path-Incomplete (EPI) SSRF class as a coverage defect, P ⊊ E, where E is the set of outbound clients and P the subset on which the guard actually runs, and we show that any client in E \ P is a full-strength SSRF primitive regardless of guard quality. CVE-2026-33234 in AutoGPT (170k+ GitHub stars) is the instance: validate_url_host() governs backend/util/request.py, while SendEmailBlock reaches the network through smtplib.SMTP(smtp_server, smtp_port) and calls none of it. A protocol-parser mismatch upgrades the bug from blind to non-blind: smtplib expects a 220 greeting, so a non-SMTP service's banner is placed into an SMTPConnectError and echoed to the user. A blind SSRF becomes a non-blind internal port scanner leaking exact version strings at roughly log2 3 ≈ 1.58 bits of topology per API call. We give the fix (guard the socket, not the URL), note that the shipped 0.6.52 patch re-resolves the hostname at connect and so leaves a DNS-rebinding TOCTOU open, and describe a dominator-analysis coverage audit that finds the class mechanically.
Index terms: SSRF, AI agents, egress control, DNS rebinding, TOCTOU, cloud metadata, CWE-918.