diff --git a/src/cai/tools/reconnaissance/filesystem.py b/src/cai/tools/reconnaissance/filesystem.py
index 8f9f4c98..feaf075a 100644
--- a/src/cai/tools/reconnaissance/filesystem.py
+++ b/src/cai/tools/reconnaissance/filesystem.py
@@ -5,6 +5,14 @@ Here are the CLI tools for executing commands.
 from cai.tools.common import run_command  # pylint: disable=E0401
 from cai.sdk.agents import function_tool
 
+# Dangerous flags that enable RCE, file writes, or file deletion
+DANGEROUS_FIND_FLAGS = {
+    "-exec", "-execdir", "-ok", "-okdir",
+    "-delete",
+    "-fprintf", "-fprint", "-fls", "-fprint0",
+    "-print0",
+}
+
 @function_tool
 def list_dir(path: str, args: str = "", ctf=None) -> str:
     """
@@ -61,5 +69,10 @@ def find_file(file_path: str, args: str = "", ctf=None) -> str:
     """
     Find a file in the filesystem.
     """
+    # Block dangerous flags that enable RCE, file writes, or deletion
+    for flag in DANGEROUS_FIND_FLAGS:
+        if flag in args:
+            return f"Error: DANGEROUS flag '{flag}' is not allowed"
+    
     command = f'find {file_path} {args}'
     return run_command(command, ctf=ctf)