# EscapeRoute — Filesystem MCP Symlink Escape to LaunchAgent Persistence (CVE-2025-53109)

- **Severity:** High
- **Signature ID:** `d75ed6d2-d344-4575-9606-5ffc3c1c7d39`
- **CVEs:** CVE-2025-53109
- **MITRE ATLAS:** AML.T0051.001 (Indirect), AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), ASI05 (Cascading Failures in Multi-Agent Systems), LLM05 (Improper Output Handling), LLM06 (Excessive Agency)

## Summary

Anthropic's Filesystem MCP Server let an AI agent follow a symlink without checking where it actually pointed. An attacker could plant a symlink inside a folder the agent was allowed to write to, then have the agent write through it to a sensitive system file, escaping the sandbox entirely.

## How the attack works

An attacker creates a symlink inside a directory the filesystem MCP server is permitted to write to, but the symlink itself points somewhere else on disk, such as a macOS LaunchAgents folder or /etc/sudoers. The attacker then asks the agent to write a file through that symlink using the server's write_file tool. Because the server did not re-check the resolved target against its allowed-directory list, the write lands on the real, privileged target instead of the sandboxed one. The published proof of concept drops a malicious LaunchAgent plist so code runs automatically every time the user logs in.

## Why it matters

An attacker with only sandbox-limited file write access can gain persistent code execution on the host, or tamper with privilege files like /etc/sudoers, effectively breaking out of the confinement the MCP server was supposed to enforce.

## What you can do

- Upgrade Anthropic's Filesystem MCP Server to 0.6.3 / 2025.7.1 or later, which re-validates the resolved (realpath) target against the allowed directory.
- Until patched, avoid granting the filesystem MCP server write access to directories where an untrusted party could plant symlinks.
- Monitor for writes through symlinks that resolve to persistence-relevant paths: LaunchAgents plists, cron files, authorized_keys, systemd units, or /etc/sudoers.
- Review existing LaunchAgents, cron jobs, sudoers entries, and systemd units for unexpected additions if this server was exposed before patching.

## Known benign look-alikes

- Legitimate developer use of symlinks inside a project (ln -s ../shared node_modules, dotfile symlink managers like stow) where there is no filesystem-MCP write to a persistence/privileged target. This rule requires the symlink/write operation to co-occur with a known persistence path (LaunchAgents plist, /etc/sudoers, cron, authorized_keys, systemd unit), not any symlink.
- Advisory or research text naming CVE-2025-53109, EscapeRoute, or the LaunchAgent PoC without a live symlink-create or write-through operation via the filesystem MCP.
- Applications that legitimately install their own LaunchAgent/systemd unit through their platform installer (not via a filesystem MCP tool write through a symlink); the rule anchors on the filesystem-MCP write / symlink construct plus the sandbox-escape framing.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02024
- https://cymulate.com/blog/cve-2025-53109-53110-escaperoute-anthropic/
- https://nvd.nist.gov/vuln/detail/CVE-2025-53109

---
Source: https://www.netzilo.com/threats/atr-escaperoute-filesystem-mcp-symlink-escape-to-launchagent-per