High
github
·
GHSA-j659-8xh6-5pq5
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard
Published Aug 17, 2026
CVSS 0.0
_estimate_batch_cost (atomic_agents/agent.py) looks up the per-model output price with PRICING.get(model, {}), returning 0.0 for any model not in the hardcoded pricing table. _check_batch_reservation then early-returns when the reservation is 0 and that an over-cap unknown-model batch raises CostGuardrailBlocked.
Affected AI Products
ollama
vllm