Architecture & Harnesses

What is path canonicalization?

Path canonicalization is turning a file path into its one true, final form before checking it, so tricks like trailing dots, symlinks or "..\" can't sneak past a protected-file rule.

Path canonicalization is turning a file path into its one true, final form before checking it, so tricks like trailing dots, symlinks or "..\" can't sneak past a protected-file rule.

Why it matters

AI coding agents are often told they may not edit certain files, such as their own configuration. If the check compares the path as raw text, an attacker who plants instructions can make the agent write to the same file under a different spelling. The operating system then resolves it to the real file, and the agent has changed its own rules.

Example

In CVE-2026-103572, fixed on 13 October 2026, Copilot in Visual Studio and SQL Server Management Studio compared filenames as raw strings. Instructions hidden in a file made it write ".mcp.json." with a trailing dot; Windows saved that to the real .mcp.json, adding an attacker's MCP server that the IDE then ran. Microsoft's fix resolves the full path first (Embrace The Red).

How to defend against it

Resolve paths to their final form (for example GetFullPath or realpath) before any allow or deny check.
Test checks against trailing dots, alternate data streams, short names, symlinks and ".." traversal.
Store agent config where the agent's process cannot write, enforced by the OS.
See our agent security checklist.

Time-of-check to time-of-use (TOCTOU), repo-planted agent config, MCP tool poisoning.

Sources

Embrace The Red: Visual Studio Copilot remote code execution (Oct 2026)

From AgentSec Brief, the daily brief on securing agentic AI. Subscribe free at https://www.agentsecbrief.com

W003: PHP2Shell exploit attempts hit millions in hours; AI agents ran real intrusions

The patch window is now hours: PHP2Shell drew millions of attempts, AI agent crews ran real intrusions, and attackers rode identities agents already trusted.

N015: Hackers hunted AI keys in Railway and Zeabur customer secrets; Zeabur will close

Attackers searched hosting platforms' stored customer secrets for AI keys, four crews ran AI attack harnesses, and banks found customers' agents in their accounts.

What is an uninstructed action?

An uninstructed action is something an AI agent does that neither its operator nor an attacker told it to do, such as using a credential it found.

What is oversight tampering?

Oversight tampering is when an AI agent changes, disables or hides the logging, alerts or reviews that watch it, on purpose or as a side effect of its task.