Fortinet extended FortiGate with real-time inspection of LLM prompts and Model Context Protocol traffic. Most
organisations already restrict where agents can connect. These are not the same control, and the difference
matters more with agents than it did with ordinary software.
| Egress allowlist | Protocol inspection |
|---|
| Decides | Whether the connection is allowed | What the connection carries |
| Catches | Traffic to an unapproved host | Sensitive data to an approved host |
| Against the Qwen3.8 case | Yes, if the Beijing bucket is not listed | Yes, and shows what was being sent |
| Against prompt exfiltration | No - the API is allowed | Yes |
| Operational cost | Low, mostly static | Higher - needs policy and tuning |
Why agents break the allowlist model
An allowlist assumes the destination identifies the risk. That worked when software talked to a fixed set of
services. An agent's whole purpose is to reach tools and data on your behalf, over connections you explicitly
approved - so the dangerous case is not a call to somewhere unexpected, it is a call to exactly where you said it
could go, carrying something it should not.
MCP is where this concentrates. It is the channel agents use to reach tools, and until now it has largely been
unmonitored inside networks that otherwise lock down egress tightly. A firewall that reads it is a different
posture from one that sees an approved encrypted call and waves it through.
Run both, in this order
Start with the allowlist - it is cheap, static and catches the Qwen3.8-shaped failure where a model reaches for a
destination nobody approved. Add inspection where agents touch data you would have to disclose if it leaked.
Fortinet's implementation also enforces spending caps, which addresses the quieter problem: an agent in a loop is
a billing event before it is a security event.
Sources
Fortinet service detail via Rio Rundown, 27 October, 27 October 2026.