Phi EUVD-2026-96399

Exploitation requires all of: (1) the Phi agent (versions 0.3.0 through 0.28.4) processing attacker-influenced/untrusted content that carries prompt-injected instructions; (2) the sub-agent spawning capability (agent_spawn) being reachable to the agent; and (3) the workspace_only_writes or readonly protection modes being relied upon, since the flaw is that agent_spawn accepts an unchecked workdir that escapes them. Limiting factors: the attack requirement (AT:P) and passive user interaction (UI:P) mean a user must actually run the agent over the malicious content; impact is confined to file writes in locations the running user can already write to (no privilege escalation beyond the user, no confidentiality or availability impact).

This is a medium-severity authorization flaw (CWE-863), rated CVSS 4.0 6.0, whose signals point to real-but-bounded risk rather than a top-tier emergency. The provided 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N) shows integrity-only impact (unapproved file writes) with no confidentiality or availability loss, and critically includes AT:P (a specific attack requirement) plus UI:P (user must process attacker content) - so exploitation is not a simple drive-by despite the network vector and lack of required privileges. No EPSS score was supplied, and the CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation. No weaponized public exploit was identified at time of analysis, though a detailed technical write-up (hackmd) and direct source-line references exist, lowering the effort to reproduce. The practical priority is tempered by prerequisites: the victim must run Phi against untrusted content while workspace_only_writes/readonly protections are in use and sub-agent spawning is available. Net: a credible prompt-injection privilege/sandbox-escape in an AI agent tool worth patching, but the niche product footprint and required conditions make widespread opportunistic exploitation unlikely; treat as targeted. MISSING DATA: no EPSS, no confirmed patched version in the input, and POC status is inferred (write-up exists, no distributable exploit stated).

An attacker seeds prompt-injected instructions into content the Phi agent will process (e.g., a source file, document, or web page), instructing the agent to invoke agent_spawn with a workdir pointing outside the confined workspace. When the victim runs the agent over that content, the spawned sub-agent inherits no workdir validation and writes files anywhere the user can write, defeating workspace_only_writes and readonly mode. No distributable public exploit is noted, but a detailed technical write-up and the vulnerable source lines are publicly referenced.