What breaks when URL schemes are not restricted in agent clients?

Untrusted schemes can move a workflow from normal login into command injection, local file execution, XSS, or token theft. Once the client accepts arbitrary schemes, the attacker no longer needs direct server compromise. They only need the client to interpret their URL as something executable or scriptable.

Why This Matters for Security Teams

URL-scheme allowlists are not a cosmetic hardening step for agent clients. When an autonomous or semi-autonomous client accepts arbitrary schemes, it may hand attacker-controlled input to an operating system handler, browser, shell, or installed application. That turns a link click into a trust boundary failure, especially in workflows that use OAuth, chat-to-action bridges, or local companion apps. The risk is broader than phishing because the client itself becomes the interpreter. NHI Mgmt Group’s Ultimate Guide to NHIs shows how often secrets and privileges are already overexposed, which makes client-side scheme handling an easier pivot point for attackers.

Agentic systems also amplify the blast radius. A malicious scheme can redirect an agent into an unintended login flow, token handoff, or local execution path, which is exactly why current guidance in the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework emphasizes runtime trust decisions over blind input acceptance. In practice, many security teams encounter this only after an agent has already followed a crafted link into token theft or local code execution.

How It Works in Practice

Restricted schemes should be treated as a client-side control, not a convenience feature. The safest pattern is to permit only the exact schemes needed for the workflow, then route every other URI through a neutral renderer or block it outright. For agent clients, that usually means allowing

http

and

https

for ordinary navigation, while explicitly denying custom handlers unless there is a documented business need and a security review.

At runtime, the client should validate the full URI before any redirect, open, or callback action. That includes checking the scheme, host, path, and whether the destination requires privileged context. If the client supports tool invocation or embedded browser handoffs, the scheme decision should be tied to policy, not string matching alone. This aligns with the direction described in CSA MAESTRO agentic AI threat modeling framework and reinforced by NHI-focused operational analysis such as OWASP NHI Top 10.

• Use an allowlist of approved schemes, not a blocklist of known-bad patterns.
• Bind callback URLs to the intended app, tenant, and session state.
• Refuse schemes that can launch local handlers, scripts, or file paths unless explicitly required.
• Keep secrets out of URL fragments, query strings, and custom handler payloads.
• Log rejected schemes as security events so abuse attempts can be correlated quickly.

For agentic workflows, this matters because a single misrouted URI can turn a harmless-looking action into browser escape, local file access, or credential exfiltration. These controls tend to break down when the agent client inherits desktop URL handlers from the host operating system without a dedicated policy layer.

Common Variations and Edge Cases

Tighter scheme controls often increase integration friction, requiring organisations to balance user convenience against attack surface reduction. That tradeoff is real in desktop agents, mail clients, and browser extensions that rely on custom handlers for sign-in or deep linking. Current guidance suggests documenting every exception, because there is no universal standard for which non-web schemes are safe across platforms.

One common edge case is OAuth or SSO flows that use custom redirects. Those flows must be tightly scoped, because a permissive handler can leak codes or tokens into a malicious local app. Another is file-based automation, where CoPhish OAuth Token Theft via Copilot Studio illustrates how an apparently normal interaction can become a credential theft path once the client follows an unsafe destination. The same lesson appears in Analysis of Claude Code Security, where workflow trust depends on constraining what the assistant is allowed to launch or execute.

Best practice is evolving for agent clients that mix browser, shell, and tool execution. Until stronger platform standards settle, the safest rule is simple: if the scheme is not explicitly required for the task, it should not be accepted.

Related resources from NHI Mgmt Group

• What breaks when agent identity is only managed as secret rotation?
• What breaks when security teams rely on content guardrails to control AI agents?
• What breaks when a vendor-shared GitHub PAT is not revoked?
• What breaks when Kubernetes exec is not tightly controlled?