Google’s AX Takes a Port in Every Egress Rule. Nothing Downstream Can Enforce One.

Author(s): Chew Loong Nian – AI ENGINEER Originally published on Towards AI. Google's AX Takes a Port in Every Egress Rule. Nothing Downstream Can Enforce One. Google’s agent orchestrator sets a port on six egress rules in its own repo. I traced all six to a wire format with no port field in it — and the CLI prints them back at you anyway. The article dissects Google’s AX “Gateway” egress policy schema and shows that while manifests declare a host+port allowlist, the compiled wire protocol that reaches Agent Substrate never actually includes a port field. The author demonstrates this by tracing code and running a script that inspects the AX wire-path implementation, confirming that the Gateway’s port is read/printed by the CLI but never survives into the enforcement rule where only hostname/IP matchers are evaluated. Substrate parses the destination authority to separate a port value internally, but evaluation logic never consults it when applying rules, and hostname matching explicitly rejects host strings that include ports, preventing any “api.openai.com:443” style smuggling. The post also highlights additional “fail-open” behaviors (missing or unresolved gateway names, wildcar…

≈