Phi
Monthly
Symlink-based workspace escape in phi 0.1.1 through 0.28.4 lets a malicious repository bypass the agent's workspace_only_writes permission gate and cause the write tool to modify files outside the workspace. The gate compares only the lexical path string, so a symlink committed in the repository that resolves outside the workspace passes validation once prompt injection steers the agent's write tool at that path; the resulting impact is integrity-only (unauthorized out-of-workspace writes) with no confidentiality or availability loss, consistent with the assessed CVSS:3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N and the reported CVSS 4.0 base of 5.7. Exploitation is local and requires the victim to run the agent against an attacker-influenced repository with workspace_only_writes active, making this a medium-severity sandbox escape rather than a remote threat; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Sub-agent spawning in the Phi AI agent (versions 0.3.0 through 0.28.4) accepts an unchecked workdir argument, allowing a spawned worker to be rooted outside the intended workspace and thereby bypass the workspace_only_writes and readonly protection modes. Untrusted or attacker-influenced content processed by the agent can carry prompt-injected instructions that trigger a spawn with an alternate working directory, resulting in unapproved file writes anywhere the user running Phi already has write permission. The flaw is rated CVSS 4.0 6.0 (CWE-863 incorrect authorization), is remotely reachable without credentials but requires passive user interaction and a pre-existing agent deployment; no public exploit identified at time of analysis, and impact is bounded to integrity (no confidentiality or availability loss) with no privilege gain beyond the invoking user.
Symlink-based workspace escape in phi 0.1.1 through 0.28.4 lets a malicious repository bypass the agent's workspace_only_writes permission gate and cause the write tool to modify files outside the workspace. The gate compares only the lexical path string, so a symlink committed in the repository that resolves outside the workspace passes validation once prompt injection steers the agent's write tool at that path; the resulting impact is integrity-only (unauthorized out-of-workspace writes) with no confidentiality or availability loss, consistent with the assessed CVSS:3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N and the reported CVSS 4.0 base of 5.7. Exploitation is local and requires the victim to run the agent against an attacker-influenced repository with workspace_only_writes active, making this a medium-severity sandbox escape rather than a remote threat; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Sub-agent spawning in the Phi AI agent (versions 0.3.0 through 0.28.4) accepts an unchecked workdir argument, allowing a spawned worker to be rooted outside the intended workspace and thereby bypass the workspace_only_writes and readonly protection modes. Untrusted or attacker-influenced content processed by the agent can carry prompt-injected instructions that trigger a spawn with an alternate working directory, resulting in unapproved file writes anywhere the user running Phi already has write permission. The flaw is rated CVSS 4.0 6.0 (CWE-863 incorrect authorization), is remotely reachable without credentials but requires passive user interaction and a pre-existing agent deployment; no public exploit identified at time of analysis, and impact is bounded to integrity (no confidentiality or availability loss) with no privilege gain beyond the invoking user.