VulnWatch VulnWatch
← Back to dashboard
High github · GHSA-j659-8xh6-5pq5

atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard

Published Aug 17, 2026 CVSS 0.0

_estimate_batch_cost (atomic_agents/agent.py) looks up the per-model output price with PRICING.get(model, {}), returning 0.0 for any model not in the hardcoded pricing table. _check_batch_reservation then early-returns when the reservation is 0 and that an over-cap unknown-model batch raises CostGuardrailBlocked.

Affected AI Products

ollama vllm
Get the weekly digest. Every Monday: top AI security stories of the week. Free.