High

Agent / MCP tool path traversal and arbitrary file access

Some AI agent systems let the AI call tools that read or write files, such as retrieving a document or saving output. If the tool doesn't check the path carefully, an attacker can supply a path like '../../etc/passwd' or a URL-encoded version of it to escape the intended folder and reach arbitrary files on the system.

How the attack works

The agent exposes a file-handling tool (via MCP or similar) that accepts a path or filename argument. An attacker, either directly or through a manipulated prompt, supplies a value containing directory traversal sequences ('../../..') or their URL-encoded equivalents. If the tool passes this argument to the filesystem without normalizing and restricting it to an allowed base directory, the attacker's crafted path resolves to a location outside the intended sandbox. The same flaw also enables 'zip-slip', where an archive extracted by the agent contains entries with traversal paths that write files anywhere on disk.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID
4d691ac5-ff1b-4b84-9098-3de69b7c540a
Severity
High
Classification
AML.T0057 · LLM Data Leakage ASI01 · Agent Authorization and Control Hijacking LLM02 · Sensitive Information Disclosure

Why it matters

An attacker can read sensitive files (credentials, configuration, other users' data) or overwrite files outside the intended directory, leading to data leakage or, if writable paths include executable locations, further compromise.

What you can do

  • →Resolve all file paths to an absolute canonical form and verify they stay inside the allowed base directory before any read or write.
  • →Reject inputs containing '../', encoded traversal sequences, or absolute paths where only relative filenames are expected.
  • →When extracting archives, validate each entry's resolved path against the target directory before writing (prevents zip-slip).
  • →Run file-handling tools with the minimum filesystem permissions needed, and log/monitor tool calls with unusual path arguments.

Known benign look-alikes

  • Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.

References

Related threats

Bestiality Content Acquisition & Distribution
This rule flags attempts to get an AI agent to search for bestiality video content, download it, and publish it to social media…
Darknet Controlled-Substance Procurement
This rule flags conversations where a user directly instructs an AI agent to purchase controlled substances such as hashish, DMT…
DDoS Attack Orchestration
An attacker asks an AI agent to fetch a denial-of-service tool, identify a target IP from leaked data, and use both to attack…
DoNotAnswer Malicious Use — Illegal Activity Facilitation Request
This rule flags user prompts that directly ask an AI assistant for help committing illegal acts — making drugs, trafficking…