Pydantic Ai Harness
Monthly
Pydantic AI Harness versions before 0.59.0 fail to enforce the operator-configured UsageLimits.tool_calls_limit for nested tool invocations dispatched from inside a sandboxed run_code snippet in the CodeMode toolset, letting a program call run_nested_call() repeatedly and reach costly or side-effecting tools far beyond the intended ceiling. Unauthenticated remote attackers who can shape the agent's execution - as a user of the agent or through prompt-injected content - can therefore bypass a guardrail that operators rely on for cost and safety control, with impact bounded to resource exhaustion/limit violation rather than data exposure or code execution. This is a moderate CWE-770 resource-throttling flaw; no public exploit code or active exploitation was identified at time of analysis, and the vendor has released 0.59.0 to correct it.
Pydantic AI Harness versions before 0.59.0 fail to enforce the operator-configured UsageLimits.tool_calls_limit for nested tool invocations dispatched from inside a sandboxed run_code snippet in the CodeMode toolset, letting a program call run_nested_call() repeatedly and reach costly or side-effecting tools far beyond the intended ceiling. Unauthenticated remote attackers who can shape the agent's execution - as a user of the agent or through prompt-injected content - can therefore bypass a guardrail that operators rely on for cost and safety control, with impact bounded to resource exhaustion/limit violation rather than data exposure or code execution. This is a moderate CWE-770 resource-throttling flaw; no public exploit code or active exploitation was identified at time of analysis, and the vendor has released 0.59.0 to correct it.