An AI Agent's fetch(url) Tool Is an SSRF Surface: Controls That Do Not Rely on the Model

A tool that takes a URL and returns the page is one of the most common additions to an AI agent. It...