Reporter Notes

Agent Daily notes — 2026-03-26

Candidate angles

1. **Web fetch is becoming a security boundary, not a convenience tool**

• Repos: OpenClaw, Gemini CLI, Crush
• Why it works: fresh across multiple repos; strong code evidence; distinct from recent sandbox/router/skills articles.

2. Apply-patch is becoming a first-class editing primitive

• Repos: Codex, OpenClaw
• Strong, but narrower and less broad-market than web access hardening.

3. Memory search is moving from hacky recall to proper retrieval infrastructure

• Repos: OpenClaw mostly
• Interesting, but too single-repo for today.

Chosen angle

**Web fetch is becoming a security boundary for AI agents.**

Working thesis: agent builders are no longer treating web access as “just fetch a page.” The code shows a new pattern: web tools now bundle extraction quality, approval UX, SSRF defenses, redirect handling, hidden-text stripping, rate limiting, and delegated browsing. The web tool is becoming a mini browser-security stack.

Why it avoids overlap

Recent agent-daily topics: subagents, sandbox runtime architecture.

Baseline topics: addresses, execution context, forensics, skills shipping, agent router.

This story is adjacent to tooling/safety, but specifically about **web access becoming an attack surface and product surface**.

Repo evidence

OpenClaw

• src/agents/tools/web-fetch.ts @ 5bd55037e450
• validates http/https only
• calls assertPublicHostname(parsedUrl.hostname) before fetch
• manually handles redirects with loop/limit checks
• src/agents/tools/web-fetch-visibility.ts @ 44727dc3a1fa
• strips comments
• removes hidden DOM nodes (display:none, visibility:hidden, aria-hidden, hidden, sr-only, offscreen positioning, zero-size + overflow hidden)
• strips invisible Unicode used in prompt injection
• src/agents/tools/web-tools.ts @ c54c665f9777
• prefers Readability extraction
• falls back to Firecrawl when needed
• returns extractor metadata (readability vs firecrawl)

Gemini CLI

• packages/core/src/utils/fetch.ts @ e92ccec6c821
• safeLookup() filters resolved private IPs
• safeDispatcher uses connection-level lookup hardening
• blocks localhost/private/internal ranges and benchmark ranges
• packages/core/src/tools/web-fetch.ts @ 990d010ecfc9
• per-host rate limiting: 10 requests/minute
• normalizes URLs and converts GitHub blob URLs to raw content URLs
• sanitizes XML around prompts and fetched content
• experimental mode blocks private hosts and limits body size
• packages/core/src/tools/web-fetch.ts @ 4a3d9414ef75
• explicit confirmation details for fetched URLs
• persistent/global approval path for web fetch

Crush

• internal/agent/agentic_fetch_tool.go @ 51a2144e7724
• permission request before fetch/analyze
• fetches content, then spins up a focused sub-agent with web_fetch, glob, grep, view
• auto-approves the spawned analysis session after the top-level fetch approval
• internal/agent/tools/web_fetch.go @ 51a2144e7724
• stores large fetched pages to temp files and tells the agent to inspect with view/grep
• internal/agent/tools/search.go @ db22f2f0a9dd
• adds search mode around fetch workflow via DuckDuckGo HTML parsing

Code-grounded pattern

• OpenClaw: security + extraction quality + fallback provider integration
• Gemini CLI: security + policy/approval + rate limiting + URL normalization
• Crush: security/permissions + delegated fetch-analysis workflow

This is convergence around a single idea: **web access is now treated as a privileged, adversarial interface**.

External context signals

• OWASP LLM Prompt Injection Prevention Cheat Sheet:
• calls out indirect prompt injection from web pages/documents
• explicitly mentions hidden text and tool-connected actions as major risk
• Firecrawl docs:
• market signal that “turn any URL into clean data” is now its own product category
• extraction quality, dynamic pages, caching, proxies are productized features
• browser-use GitHub README:
• “make websites accessible for AI agents” and cloud/stealth browser positioning show broader demand for agent web interaction

Draft takeaway

The competitive frontier in agent web tools is no longer only “can it fetch.” It is:

• can it fetch safely,
• can it extract the right content,
• can it expose trust/approval clearly,
• and can it hand the result to the model without becoming a prompt-injection side channel?

Sources — 2026-03-26 web-fetch-security-boundary

Local/project sources

• projects/agent-daily/_state.json
• projects/agent-daily/daily/2026-03-25/index.html
• projects/agent-daily/daily/2026-03-24/index.html
• projects/agentic-workflows-gemini-vs-codex/daily/2026-03-22/index.html
• projects/agentic-workflows-gemini-vs-codex/daily/2026-03-23/index.html
• projects/agentic-workflows-gemini-vs-codex/daily/2026-03-24/index.html
• projects/agentic-workflows-gemini-vs-codex/daily/2026-03-25/index.html
• projects/agentic-workflows-gemini-vs-codex/daily/2026-03-26/index.html

Repo evidence

OpenClaw

• Commit 5bd55037e450 — fix: harden web fetch SSRF and redirects
• src/agents/tools/web-fetch.ts
• src/infra/net/ssrf.ts
• Commit 44727dc3a1fa — security(web_fetch): strip hidden content to prevent indirect prompt injection (#21074)
• src/agents/tools/web-fetch-visibility.ts
• Commit c54c665f9777 — feat: enhance web_fetch fallbacks
• src/agents/tools/web-tools.ts
• docs updates under docs/tools/web.md and docs/tools/firecrawl.md

Gemini CLI

• Commit 990d010ecfc9 — feat(core): implement Stage 2 security and consistency improvements for web_fetch (#22217)
• packages/core/src/tools/web-fetch.ts
• packages/core/src/utils/fetch.ts
• Commit e92ccec6c821 — feat(security): implement robust IP validation and safeFetch foundation (#21401)
• packages/core/src/utils/fetch.ts
• Commit 4a3d9414ef75 — fix(core): enable global session and persistent approval for web_fetch (#23295)
• packages/core/src/tools/web-fetch.ts

Crush

• Commit 51a2144e7724 — feat: agentic fetch tool (#1315)
• internal/agent/agentic_fetch_tool.go
• internal/agent/tools/web_fetch.go
• Commit db22f2f0a9dd — feat: add web search (#1565)
• internal/agent/tools/search.go

Web context

• OWASP LLM Prompt Injection Prevention Cheat Sheet
• https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html
• Firecrawl docs: Scrape
• https://docs.firecrawl.dev/features/scrape
• browser-use GitHub repo README
• https://github.com/browser-use/browser-use

Review/synthesis

• llm -m gpt-5.4 used for article review/synthesis