Symlinks let coding agents write files outside their sandbox

Two AI coding agent frameworks contain flaws that let attackers write files outside the agent's workspace, according to entries added to the US National Vulnerability Database on 10 October 2026. The affected products are phi, from Pulse AI Club, and open-multi-agent, published as the npm package @open-multi-agent/core. Both issues involve improper handling of symbolic links, which are file system entries that point to another location on disk.

The first advisory, CVE-2026-108599, covers phi versions 0.1.1 through 0.28.4. The NVD entry says the framework's permission gate performs lexical-only path checks, meaning it compares the text of a file path rather than resolving where that path actually leads. As a result, a malicious repository can bypass the workspace_only_writes restriction. According to the entry, an attacker can commit symlinks that point outside the workspace and then use prompt injection, where hidden instructions in content the agent reads steer its behaviour, to make the write tool put attacker-influenced content into external files without approval.

The second advisory, CVE-2026-108600, covers open-multi-agent versions 1.5.0 through 1.21.2. The NVD entry describes a link following vulnerability in the sandbox around the file_write tool. It says attackers can plant a dangling symlink in the workspace, a link that points at a file that does not yet exist, and then steer the agent through prompt injection to create files outside the workspace root. The entry states that the agent can be made to write attacker-influenced content anywhere the agent process itself has permission to write.

Both NVD records point to the frameworks' public source repositories and to specific lines of code. For phi, the references identify the permission gate and the write tool. For open-multi-agent, the references identify the built-in file-write tool and a path-safety module. Both entries also link to write-ups hosted on HackMD and to advisories published by VulnCheck.

The two cases share a common pattern. In each framework, the safety control that is meant to keep an agent's file writes inside a project directory can be defeated because the check does not follow where a symlink actually points. The restriction looks sound when the path is examined as a string, but the operating system resolves the link to a different destination when the write happens. Prompt injection supplies the second half of the attack, by giving an attacker a way to direct the agent's actions through data the agent processes, such as the contents of a repository it has been asked to work on.

The NVD entries do not state that either flaw has been exploited against real users, and they do not list fixed versions. The status of both reports is recorded as reported. Neither Pulse AI Club nor the open-multi-agent project has published a statement in the material referenced by the NVD entries beyond the linked source code.

Users of either framework should check which version they are running against the affected ranges listed in the advisories. Both vulnerabilities assume the agent is pointed at content an attacker can influence, such as an untrusted repository, so limiting what an agent process is permitted to write to on the host remains relevant while fixes are awaited.