AI exploit network leg (HTTP)

What it is

When the AI exploit engine investigates a service whose host was discovered by an internal agent, every HTTP request the agent’s tool-use loop wants to issue is RELAYED through the agent: queued as a proxy_http task, executed inside the customer network, response shipped back. The engine’s higher layers (reasoning, finding generation, replay capture) are oblivious; the relay is transparent at the performHTTP boundary.

For non-HTTP services (Postgres, MySQL, Redis, MongoDB, SSH, SMTP, FTP, etcd, ICS/OT), see the companion binary-protocol relay (same mechanism, raw bytes instead of an HTTP envelope).

What it produces

• A proxy_http row in agent_tasks for every relayed request, with method / URL / status / elapsed_ms / body (durable, audit- queryable)
• An audit_log entry tagged agent.proxy_http.create for every relayed request, with the run_id + actor user
• The same finding artefacts as direct-dial exploitation (verdict, PoC exchange, share link)

What to use it for

• Validating web-app CVEs on internal admin panels (Jenkins, GitLab, Grafana, Kibana, RabbitMQ mgmt, Vault, Nomad, K8s API)
• Reproducing exploit chains against staging environments before prod
• Demonstrating exploitability to a vendor that says “this CVE isn’t real on our appliance”: replay the relayed exchanges

Why it matters

This is half of the killer feature (the other half is the TCP relay, binary protocols). Most attack-surface tools either run exclusively from the cloud (and can’t reach RFC1918), or run exclusively on-prem (and don’t get the AI / fingerprint / CVE intel of a SaaS). Umbra runs the intelligence in the cloud and the network leg inside your network. One dashboard, two surfaces, identical capability.

Why it’s valuable

• Transparent to the AI engine. No special “internal mode”: the agent shim sits below the tool-use boundary so every exploit type (per-CVE, default-creds, full LLM run) just works.
• Audit-replayable. Every byte the agent sent on your behalf is preserved. A customer can prove exactly what we did, end-to- end.
• Scope-locked. The agent’s CIDR allowlist applies to the relay too. Proxy requests outside scope are refused at the agent before any socket opens.
• DNS-rebinding mitigated. URL hosts are resolved; every resolved IP must be in scope (not just one). Refuses anything that resolves to a non-scoped address.

How to use it

Nothing to configure. Trigger any AI exploit run against an internal service the same way you would against an external one: “Run AI exploit” on the service detail drawer, “Verify” on a CVE row, the AI batch on a finding. The engine detects the target’s AgentID and relays automatically.

The transcript shows (via agent #N) next to every relayed exchange so the replay viewer is honest about how the request got there.