Security researchers have discovered a critical flaw in NLWeb, a new tool unveiled by Microsoft just over two months ago, that allows remote users to read sensitive files without authorization.
NLWeb is a so-called agentic AI tool that allows users to search web pages using a generative AI chatbot, which will remember the users’ preferences.
Ramanathan Guha, a technical fellow at Microsoft, demonstrated how this works using the website Serious Eats during Microsoft Build in May 2025.
While searching for recipes for the Hindu festival of Diwali, Guha mentioned to the chatbot that he is vegetarian. According to Guha, this means the website will only recommend vegetarian recipes when he’s searching for inspiration from now on.
So far, so useful, but it seems new and exciting tools open the door to new and exciting vulnerabilities.
The bug was discovered by Aonan Guan and Lei Wang in a security audit of the NLWeb open source repository.
According to Guan, who wrote about his discovery in a Medium post, the flaw “allowed any remote user to read sensitive files, including system configurations (/etc/passwd) and cloud credentials (.env files), using a simple, malformed URL”.
Guan identified a code block using os.path.normpath() that he said “immediately raised a red flag”.
“The function normalizes path separators but does not prevent a user from "climbing" out of the intended directory with ../ sequences. It's a classic path traversal flaw waiting to be exploited,” he noted.
Guan pointed to three separate oversights in the code that he said led to the vulnerability: improper sanitization, an expanded attack surface, and a lack of final path validation.
What’s being done about the NLWeb flaw?
While the flaw was discovered on 28 May and a vulnerability report submitted the same day, Guan has only just made his and Lei’s findings public.
Additionally, while Microsoft Security Response Center committed a patch on 30 June it confirmed to Guan on 1 July that it wouldn’t be issuing a CVE for the issue.
There is no suggestion from Guan that organizations deploying or experimenting with NLWeb should abandon their projects.
Instead he advises they:
- Update their instance immediately “to any version including or after commit 8ffdb0f from the official GitHub repository”
- Implement WAF/reverse proxy rules
- Never bind NLWeb directly to a public IP address, thus avoiding direct public exposure
- Configure monitoring systems to issue high-priority alerts for suspicious HTTP 404 or 400 error responses for URIs that have path traversal patterns
“This case study serves as a critical reminder that as we build new AI-powered systems, we must re-evaluate the impact of classic vulnerabilities, which now have the potential to compromise not just servers, but the ‘brains’ of AI agents themselves,” Guan said.
ITPro contacted Microsoft for comment on the report, but hadn’t received a response at the time of publication.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- NCSC says ‘limited number’ of UK firms affected by SharePoint attack
- SharePoint flaw: Microsoft says hackers deploying ransomware
- Warning issued after SharePoint flaw puts entire corporate networks at risk
-
Harrods rejects contact with hackers, after 430,000 customer records stolen from third-party providerNews The luxury department store has denied any link to a failed attack on its systems in May
-
Kido nursery hackers threaten to release more details – along with the personal data of 100 employeesNews The attack is the first to be claimed by the new threat group 'Radiant'
-
Generative AI attacks are accelerating at an alarming rateNews Two new reports from Gartner highlight the new AI-related pressures companies face, and the tools they are using to counter them
-
A terrifying Microsoft flaw could’ve allowed hackers to compromise ‘every Entra ID tenant in the world’News The Entra ID vulnerability could have allowed full access to virtually all Azure customer accounts
-
Microsoft and Cloudflare just took down a major phishing operationNews RaccoonO365’s phishing as a service platform has risen to prominence via Telegram
-
Hackers are using AI to dissect threat intelligence reports and ‘vibe code’ malwareNews TrendMicro has called for caution on how much detail is disclosed in security advisories
-
Anthropic admits hackers have 'weaponized' its tools – and cyber experts warn it's a terrifying glimpse into 'how quickly AI is changing the threat landscape'News Security experts say Anthropic's recent admission that hackers have "weaponized" its AI tools gives us a terrifying glimpse into the future of cyber crime.
-
Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b modelNews Using OpenAI's gpt-oss:20b model, ‘PromptLock’ generates malicious Lua scripts via the Ollama API.
-
Microsoft quietly launched an AI agent that can detect and reverse engineer malwareNews Researchers say the tool is already achieving the “gold standard” in malware classification
-
Flaw in Lenovo’s customer service AI chatbot could let hackers run malicious code, breach networksNews Hackers abusing the Lenovo flaw could inject malicious code with just a single prompt
