Transit builds a LangChain-style agent chain and security reviews callback URLs embedded in tool configs. Which integration-layer risk should they prioritize?

GenAI orchestration chains (LangChain-style and similar) often embed tool callbacks and HTTP fetch configurations that the agent will invoke during transit workflows. Those callback URLs are an integration-layer trust boundary: if destinations are attacker-controlled or point at unintended internal services, the tool path can enable SSRF, data exfiltration, or lateral reach into transit internals. Security should prioritize constraining and reviewing callback destinations—allowlists, private-network blocks, and outbound proxy policy—before trusting tool configs in production.

Faster boarding times caused by longer prompt templates is a distractor that confuses UX latency myths with integration risk; prompt length does not create boarding benefits and is orthogonal to callback SSRF. Automatic encryption of every GTFS file on resident phones misplaces the control—client-side GTFS encryption does not stop a server-side agent from fetching unsafe URLs. Removal of all logging so callbacks leave no audit trail worsens detection and accountability rather than addressing destination risk.

Exam caveat: SSRF here is about the tool runtime's ability to fetch URLs chosen or influenced by config and possibly by model/tool arguments—not about encrypting GTFS on phones. Operational check: inventory tool callback and fetch URLs in the transit agent, enforce HTTPS and destination allowlists, block link-local and RFC1918 targets unless explicitly approved, and alert on callback attempts to non-allowlisted hosts.