# MEDIA:/file:// Directive Injection in Tool Result for Local File Exfiltration

- **Severity:** High
- **Signature ID:** `60837ff6-aa1d-4349-bdb8-a9e9c31fe86d`
- **MITRE ATLAS:** AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI06 (Goal and Instruction Manipulation), LLM02 (Sensitive Information Disclosure)

## Summary

Some AI agent frameworks scan tool output for special MEDIA: or file:// tags and automatically attach the referenced local file's contents to outbound chat messages like Discord or Slack. A rogue or compromised connected tool can plant a tag pointing at a secrets file in the shared temp directory, and the agent will read that file and hand its contents to the attacker without checking who actually produced the path.

## How the attack works

An attacker controls or compromises a tool the agent calls (for example an MCP server). That tool returns ordinary-looking text containing a MEDIA:/path or file:// token pointing at a file in a shared, world-readable temp directory with a name that suggests credentials, such as app-secrets.env. The agent's post-processing step extracts the path, checks it only against a broad allowlist that includes the whole system temp directory by default, then reads the file and attaches it to an outbound messaging channel. No check confirms the path was ever produced by a trusted first-party tool, so any file left in temp by any process can be exfiltrated this way.

## Why it matters

An attacker who can influence one tool's output can silently exfiltrate secrets, tokens, or other sensitive files left in shared temp storage, sent straight to an external chat channel the attacker also has access to.

## What you can do

- Restrict or remove os.tmpdir()/shared temp paths from any allowlist used for auto-attaching files referenced in tool output.
- Require that MEDIA:/file:// directive tokens only resolve to paths a trusted first-party tool actually wrote in its own designated output directory, not arbitrary paths named by tool response text.
- Avoid writing secrets, credentials, or tokens to world-readable shared temp directories.
- Audit which tools/MCP servers are permitted to return unvalidated file paths and treat their output as untrusted input, not as executable instructions.

## Known benign look-alikes

- A first-party tool legitimately returning MEDIA:/path/to/its-own-output.png referencing a file it just wrote inside the application's own designated media-output directory, not a shared temp path with a secret-sounding name
- Documentation or changelog text describing the MEDIA: directive mechanism itself without an actual tool-result payload carrying it

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02104

---
Source: https://www.netzilo.com/threats/atr-media-file-directive-injection-in-tool-result-for-local-file