CVE-2026-54327: Pi Agent: Race condition in Pi auth.json writes could expose stored credentials

Exploitation requires local access to the same machine and read/traverse access to the victim’s Pi agent configuration directory. Users whose ~/.pi/agent directory is private to their account are less exposed. The main impact is disclosure of stored provider credentials, which may allow use of the configured provider accounts according to the privileges of those credentials.

This is not remotely exploitable by itself.