I don't think there's a way to make it secure while still permitting it unprompted external access

Eg: Any web request is a security vulnerability, there's no way to do it if the web requests are being made maliciously

Say that we have an agent with access to get requests, solely to a single site https://yoursite.com without subdomains. In this case multiple requests can be sent, and the time between requests can be used to exfiltrate personal data, similar to the coffee shop attack but without the subdomains. If the AI is able to make requests in any form, some information can be leaked, where the amount of leakable information is tied to information theory content of whatever side channel is being used. The only 0 information channel is.. never to make a request

You could also completely trust the 3rd party you're connecting to, but that to me seems like a hard error in the modern internet