The security issue https://www.drupal.org/sa-contrib-2026-028 did introduce a whitelist of hostnames for anything the AI produces. Since it was deemed a security issue we di a widecatching solution that means that any url anywhere is catched, including things that might look similar to the urls. With agents you might want to have the possibility to actually turn this off, for a multitude of reasons - including that you know that the output is safe or that the agent you are using does never have any context that is classified. This means that we should add the possibility to turn this off. ### Solution 1. Add a checkbox to the agent form and modeler to bypass the url whitelist 2. Add it to the agents config and schema 3. If its checked, it should reset the mode programatically, see: https://project.pages.drupalcode.org/ai/1.3.x/developers/hostname_filter/#programmatic-configuration-for-testing 4. Write tests, to make sure that this works