CVE-2026-108595 in Phi
Summary
by MITRE • 10/10/2026
Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker rooted elsewhere, causing unapproved file writes anywhere the user can write.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in Phi versions 0.3.0 through 0.28.4 represents a critical permission bypass flaw within the framework's multi-agent orchestration logic. This security defect stems from an improper validation of directory paths when initiating new agent processes via the agent_spawn function. Specifically, the system fails to enforce strict adherence to workspace confinement policies for spawned sub-agents. In secure configurations, agents are typically restricted to operating within a designated sandbox or workspace directory to prevent unauthorized access to sensitive files outside that boundary. However, due to this oversight, an attacker can manipulate the workdir parameter passed during agent initialization, effectively allowing the new process to escape its intended confinement and operate with broader filesystem privileges than originally granted by the application's security policy.
The technical mechanism of exploitation relies on the lack of input sanitization regarding the working directory path provided to the spawning function. When a user or an upstream component requests the creation of a sub-agent, they can supply a workdir argument that points outside the restricted workspace. Because the framework does not adequately validate this path against the configured security boundaries such as readonly mode or workspace_only_writes restrictions, the spawned agent inherits permissions associated with the provided directory rather than being locked to the safe zone. This architectural flaw effectively neutralizes the protective measures designed to contain potential damage from untrusted code execution within the AI agent ecosystem.
The operational impact of this vulnerability is severe, particularly in environments where Phi agents process external or user-generated content. An adversary can leverage prompt injection techniques to embed malicious instructions within processed data. These injected prompts are interpreted by the primary agent as legitimate commands to spawn a new worker process with an arbitrary working directory. Once spawned, this rogue sub-agent gains the ability to write files anywhere on the filesystem that the underlying operating system user has permission to access. This capability allows for unauthorized modification of critical configuration files, planting of persistent backdoors, or exfiltration of sensitive data by writing it to accessible locations outside the sandboxed environment.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-79 Cross-site Scripting when considering the prompt injection vector as a form of code injection into the agent's execution context. From an offensive security perspective, this behavior is consistent with ATT&CK technique T1053 Scheduled Task/Job, where malicious processes are spawned to execute unauthorized actions, and potentially T1608 Install Definite Tool if used for persistence. The ability to bypass sandboxing restrictions fundamentally undermines the principle of least privilege that AI agent frameworks strive to implement, turning a controlled execution environment into an unrestricted shell with the privileges of the running user account.
Mitigation strategies must focus on strict input validation and enhanced confinement mechanisms. Developers should immediately update Phi to versions beyond 0.28.4 where this flaw has been addressed by enforcing canonical path resolution and verifying that all spawned agents remain within their designated workspace boundaries regardless of the workdir argument provided. For systems unable to upgrade, implementing a wrapper or middleware layer that intercepts agent_spawn calls can provide temporary protection by sanitizing directory paths and rejecting any requests that attempt to traverse outside the allowed sandbox. Additionally, running AI services with minimal filesystem privileges using operating system-level controls such as SELinux or AppArmor can limit the blast radius even if this specific vulnerability is exploited, ensuring that spawned processes cannot write to critical system directories regardless of their internal configuration.