Export/Extract Tool Directory Parameter Redirected to a Credential Directory
An AI agent that can export, merge, or extract files (like a network-capture tool saving captured objects) can be manipulated into pointing its 'save to this folder' setting at a credentials directory such as ~/.ssh or ~/.aws. No path-traversal trick is needed - the folder parameter is a normal, documented tool option; the attack just sets it to a sensitive location so the export drops attacker-controlled files there.
How the attack works
An attacker crafts malicious content that the agent will process, such as a network capture file containing a hidden instruction (prompt injection) and a file named something like 'authorized_keys'. When the AI model processes this content through its export/extract tool, the injected instruction manipulates it into calling the export function with the destination directory set to a credential folder like ~/.ssh instead of the normal output location. The export tool then writes the attacker-named file directly into that folder because the tool itself has no restriction on which directories it's allowed to write to. The result is a file such as a rogue SSH key landing inside the user's real .ssh directory, ready to be used for further access.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d78778c6-9c31-4c12-bd0d-30cabe89014a
- Severity
- Critical
- CVEs
- CVE-2026-43901
Why it matters
An attacker can plant files inside SSH, AWS, GPG, Docker, or Kubernetes credential directories - for example dropping a rogue authorized_keys file - which can lead to unauthorized remote access or credential theft without any traditional path-traversal exploit.
What you can do
- →Restrict any export/merge/extract tool exposed to an AI agent to a fixed, allow-listed output directory and reject requests to write elsewhere.
- →Treat destination-directory parameters (dest_dir, output_dir, export_dir, extract_dir, save_dir) as untrusted input and validate them against a strict allowlist rather than trusting the tool's default.
- →Never let an agent process untrusted file content (like pcaps or archives) that could contain hidden instructions without isolating or sanitizing that content first.
- →Monitor and alert on any tool call whose destination directory matches known credential paths (~/.ssh, ~/.aws, ~/.gnupg, ~/.docker, ~/.kube), while excluding legitimate backup/management tools whose documented purpose is to touch those paths.
Known benign look-alikes
- A destination-directory argument pointed at the tool's own configured output/working directory (Downloads, /tmp, a project workspace), even when it is an absolute path — this rule only fires on the specific credential directories listed (.ssh, .aws, .gnupg, .docker, .kube)
- A legitimate SSH/cloud-credential management skill whose documented purpose is to read or back up its own ~/.ssh or ~/.aws directory — should be reviewed for context since the parameter shape is identical to the attack