Path Traversal in Agent File Access Requests - ATR-2026-01616 (a37e3eec-119e-5f10-b2ad-c3b31af46a82)
Detects path traversal attacks (../ sequences) in agent file-access tool arguments or user requests to read files outside the agent's authorized working directory. Attackers use "../" sequences to escape the sandboxed directory and read sensitive files: ../README.md (probe project files), ../../etc/passwd (OS credentials), or ../../../../home/user/.ssh/id_rsa (private keys). Targets agents that expose file-reading tools without path normalization or containment checks.