EscapeRoute — Filesystem MCP Symlink Escape to LaunchAgent Persistence (CVE-2025-53109)
Anthropic's Filesystem MCP Server let an AI agent follow a symlink without checking where it actually pointed. An attacker could plant a symlink inside a folder the agent was allowed to write to, then have the agent write through it to a sensitive system file, escaping the sandbox entirely.
How the attack works
An attacker creates a symlink inside a directory the filesystem MCP server is permitted to write to, but the symlink itself points somewhere else on disk, such as a macOS LaunchAgents folder or /etc/sudoers. The attacker then asks the agent to write a file through that symlink using the server's write_file tool. Because the server did not re-check the resolved target against its allowed-directory list, the write lands on the real, privileged target instead of the sandboxed one. The published proof of concept drops a malicious LaunchAgent plist so code runs automatically every time the user logs in.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d75ed6d2-d344-4575-9606-5ffc3c1c7d39
- Severity
- High
- CVEs
- CVE-2025-53109
Why it matters
An attacker with only sandbox-limited file write access can gain persistent code execution on the host, or tamper with privilege files like /etc/sudoers, effectively breaking out of the confinement the MCP server was supposed to enforce.
What you can do
- →Upgrade Anthropic's Filesystem MCP Server to 0.6.3 / 2025.7.1 or later, which re-validates the resolved (realpath) target against the allowed directory.
- →Until patched, avoid granting the filesystem MCP server write access to directories where an untrusted party could plant symlinks.
- →Monitor for writes through symlinks that resolve to persistence-relevant paths: LaunchAgents plists, cron files, authorized_keys, systemd units, or /etc/sudoers.
- →Review existing LaunchAgents, cron jobs, sudoers entries, and systemd units for unexpected additions if this server was exposed before patching.
Known benign look-alikes
- Legitimate developer use of symlinks inside a project (ln -s ../shared node_modules, dotfile symlink managers like stow) where there is no filesystem-MCP write to a persistence/privileged target. This rule requires the symlink/write operation to co-occur with a known persistence path (LaunchAgents plist, /etc/sudoers, cron, authorized_keys, systemd unit), not any symlink.
- Advisory or research text naming CVE-2025-53109, EscapeRoute, or the LaunchAgent PoC without a live symlink-create or write-through operation via the filesystem MCP.
- Applications that legitimately install their own LaunchAgent/systemd unit through their platform installer (not via a filesystem MCP tool write through a symlink); the rule anchors on the filesystem-MCP write / symlink construct plus the sandbox-escape framing.