Path Traversal in Agent File Access Requests
AI agents that can read files are sometimes given a tool for that purpose without proper restrictions. Attackers exploit this by sneaking '../' sequences into file paths to break out of the folder the agent is supposed to stay in, reaching sensitive files elsewhere on the system.
How the attack works
An attacker sends a request or tool argument containing '../' sequences instead of a normal filename. If the agent's file-reading tool does not normalize or validate the path, the traversal sequence walks up the directory tree past the intended working folder. This can reach project files like ../README.md, system files like ../../etc/passwd, or private keys like ../../../../home/user/.ssh/id_rsa. The attacker gets read access to files the agent was never meant to expose.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- cb728655-402e-413e-bed7-8d1a976822bf
- Severity
- High
Why it matters
An organization can lose confidentiality of credentials, private keys, configuration secrets, or source code that sits outside the agent's intended sandbox, giving an attacker a foothold for further compromise.
What you can do
- →Normalize and canonicalize all file paths before use, then verify the resolved path is still inside the allowed directory.
- →Reject any file-access request containing '../' or absolute paths outside the agent's working directory.
- →Run the agent's file tools with an OS-level restricted user or chroot/jail so even a successful traversal can't reach sensitive files.
- →Log and review file-access requests that fail path validation, since repeated attempts indicate probing.
Known benign look-alikes
- Relative path references in project configuration files
- Documentation examples showing ../ for educational purposes