GitHub Advisoryadvisory · PyPI

GHSA-j659-8xh6-5pq5 atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard

HIGH Published 2026-08-17 Modified 2026-08-17 Official page ↗
Ecosystem
PyPI
Packages
atomic-agents-stack
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-770
Reviewed
2026-08-17

Affected packages

• PyPI atomic-agents-stack: < 1.1.0 → fixed in 1.1.0

Description

`_estimate_batch_cost` (`atomic_agents/agent.py`) looks up the per-model output price with `PRICING.get(model, {})`, returning 0.0 for any model not in the hardcoded pricing table. `_check_batch_reservation` then early-returns when the reservation is 0 and that an over-cap unknown-model batch raises `CostGuardrailBlocked`.

Related

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References