# Path Traversal in Agent File Access Requests

- **Severity:** High
- **Signature ID:** `cb728655-402e-413e-bed7-8d1a976822bf`
- **MITRE ATLAS:** AML.T0043 (Craft Adversarial Data)
- **OWASP:** ASI03 (Identity and Impersonation), LLM02 (Sensitive Information Disclosure)

## Summary

AI agents that can read files are sometimes given a tool for that purpose without proper restrictions. Attackers exploit this by sneaking '../' sequences into file paths to break out of the folder the agent is supposed to stay in, reaching sensitive files elsewhere on the system.

## How the attack works

An attacker sends a request or tool argument containing '../' sequences instead of a normal filename. If the agent's file-reading tool does not normalize or validate the path, the traversal sequence walks up the directory tree past the intended working folder. This can reach project files like ../README.md, system files like ../../etc/passwd, or private keys like ../../../../home/user/.ssh/id_rsa. The attacker gets read access to files the agent was never meant to expose.

## Why it matters

An organization can lose confidentiality of credentials, private keys, configuration secrets, or source code that sits outside the agent's intended sandbox, giving an attacker a foothold for further compromise.

## What you can do

- Normalize and canonicalize all file paths before use, then verify the resolved path is still inside the allowed directory.
- Reject any file-access request containing '../' or absolute paths outside the agent's working directory.
- Run the agent's file tools with an OS-level restricted user or chroot/jail so even a successful traversal can't reach sensitive files.
- Log and review file-access requests that fail path validation, since repeated attempts indicate probing.

## Known benign look-alikes

- Relative path references in project configuration files
- Documentation examples showing ../ for educational purposes

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01616

---
Source: https://www.netzilo.com/threats/atr-path-traversal-in-agent-file-access-requests