Phi 0.3.0-0.28.4 Permission Bypass via Agent Spawn

Executive Summary

This vulnerability in Phi 0.3.0 through 0.28.4 allows spawned sub-agents to bypass workspace restrictions. By supplying an unchecked workdir to agent_spawn, attackers can escape workspace_only_writes and readonly modes. The sub-agent then writes files outside the intended workspace, anywhere the user has write permissions.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unauthorized sub-agent spawns with unvalidated workdir parameters. Monitor logs for agent_spawn tool usage with workdir paths outside the parent workspace. Look for prompt-injected instructions triggering sub-agent creation. Review filesystem writes in unexpected directories by child agents.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to write unauthorized files anywhere on your system where you have write access. This includes planting malicious instructions via prompt injection in processed content, leading to potential data theft, system compromise, or further attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Unauthorized file writes may result in data breaches, triggering compliance violations and legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Phi to a patched version implementing workdir validation against parent workspace. Implement strict input validation for agent_spawn workdir parameters. Disable agent_spawn in readonly mode until patched. Monitor for unauthorized file writes and sub-agent activity.

Useful 0 Not Useful 0