# Duo Agent Platform workflows fail to start — Websocket connection closes abnormally (1006) for some flows (Severity 2) **Problem**: Duo Agent Platform workflows were failing to start due to abnormal WebSocket connection closures (code 1006) when using the default agent setup with sandboxing enabled. **Impact**: New or uncustomized projects using the default Duo Agent Platform configuration could not start workflows on both GitLab.com and GDK when sandboxing was active. Mainline and custom agent setups were not affected. Early tests as of 17:25 UTC show that workflows are now starting successfully as the fix is rolled out, so remaining impact should be minimal as deployment completes. **Causes**: A recent change to the Duo Agent default configuration caused workflows to fail when sandboxing is enabled. The SRT sandbox's egress proxy does not support WebSocket upgrade requests, and the default agent configuration did not bypass the proxy for GitLab hosts, resulting in failed WebSocket connections. **Response strategy**: We merged a revert to the code change that caused the issue. The fix has been deployed to canary, staging, and is now reaching production environments as of 17:25 UTC. Early verification shows workflows are starting successfully. As a temporary workaround, users could add 'setup_script: - npm install -g @gitlab/duo-cli@8.98.0' to their agent-config.yml to restore workflow startup while the rollout completes. _This ticket was created to track_ [_INC-10719_](https://app.incident.io/gitlab/incidents/10719)_, by_ [_incident.io_](https://app.incident.io) 🔥