Tools AI Risk Radar ai-incident-0201
Incident record
Phi subagents can bypass the parent’s workspace restrictions
- Severity
- Medium
- Status
- Research
- Type
- Infra Vuln
- Target
- pulseaiclub Phi 0.3.0 through 0.28.4
- Actor
- researcher
- CVE
- CVE-2026-108595
What happened
The Phi coding agent lets a model choose a subagent’s working directory outside the parent workspace. The subagent can then write there despite the parent’s read-only and workspace restrictions.
The CVE was published on 10 October; the original researcher publication date is unconfirmed. Untrusted content must influence the model to spawn a worker in an existing directory writable by the agent process. This is the pulseaiclub coding agent. The CNA gives CVSS 3.1 score 5.3. Patch status remains unconfirmed as of 11 October.
Sources
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-108595
- Researcher disclosurehackmd.io/@haind/phi-subagent-workdir-workspace-escape
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026