title: Path Traversal in Agent File Access Requests
id: ATR-2026-01616
rule_version: 1
status: experimental
description: |
  Detects path traversal attacks (../ sequences) in agent file-access tool
  arguments or user requests to read files outside the agent's authorized
  working directory. Attackers use "../" sequences to escape the sandboxed
  directory and read sensitive files: ../README.md (probe project files),
  ../../etc/passwd (OS credentials), or ../../../../home/user/.ssh/id_rsa
  (private keys). Targets agents that expose file-reading tools without
  path normalization or containment checks.
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM02:2025
    - LLM05:2025
  owasp_agentic:
    - ASI02:2026
    - ASI03:2026
  mitre_atlas:
    - AML.T0037 - Data from Local System
    - AML.T0053 - AI Agent Tool Invocation
  mitre_attack:
    - T1083 - File and Directory Discovery
compliance:
  owasp_llm:
    - id: LLM02:2025
      context: Path traversal allows reading files outside the agent's authorized scope, potentially leaking credentials.
      strength: primary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Detection of path traversal supports MEASURE 2.7 security evaluation.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: Path traversal is an adversarial technique to escape file system boundaries; Article 15 mandates detection.
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under Clause 8.1 must canonicalise and confine agent file-access paths to the intended data scope so traversal sequences (../, encoded variants) targeting files outside that scope are rejected.
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) requires risk treatment of known attack patterns; detecting path-traversal in agent file-access requests that leaks credential and system files is such a treatment.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: path-traversal
  scan_target: tool_args
  confidence: high
agent_source:
  type: tool_call
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_args
      operator: regex
      value: (?:\.\./){2,}(?:etc/|root/|home/|proc/|var/|tmp/|dev/|usr/)
      description: Multiple ../ traversal to system directories in tool args
    - field: user_input
      operator: regex
      value: (?:\.\./){3,}(?:etc/(?:passwd|shadow|sudoers)|root/|home/[^/]+/\.ssh)
      description: Deep traversal (3+ levels) to sensitive OS paths in user input
  condition: any
  false_positives:
    - Relative path references in project configuration files
    - Documentation examples showing ../ for educational purposes
response:
  actions:
    - block_tool
    - alert
    - snapshot
  auto_response_threshold: high
  message_template: |
    [ATR-2026-01616] Path traversal detected. ../ sequence found in file
    access request. Tool call blocked.
confidence: 88