GHSA-j659-8xh6-5pq5: Pip/atomic-agents-stack vulnerability
estimatebatchcost (atomicagents/agent.py) looks up the per-model output price with PRICING.get(model, {}), returning 0.0 for any model not in the hardcoded pricing table. checkbatchreservation then early-returns when the reservation is <= 0, skipping the batch reservation entirely. That reservation is the only defense against the documented fan-out race where every parallel helper/delegate reads the identical pre-batch on-disk cost total and each passes its individual check even though the collective spend overruns the configured cap.
Impact: an operator running any model not in the pricing table (self-hosted/Ollama/vLLM, a new provider SKU) with costguardrails + dailycapusd set believes the cap protects them, but a single parallel batch can blow past the cap. The parallel-helper model argument can also be steered to an unknown id. The sibling dream.estimatedreamcost does this correctly (PRICING.get(model, fallbackpricing())), which makes this a clear defect.
Affected: agent.py (estimatebatchcost / checkbatchreservation), all versions through 1.0.0.
Fix: use PRICING.get(model, costs.fallbackpricing())['output'] (mirror dream/calccost). Add a conformance test asserting an unknown-model batch reserves > 0 and that an over-cap unknown-model batch raises CostGuardrailBlocked.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/atomic-agents-stackto a version that resolves this vulnerability.Fixed in 1.1.0 - Configuration
Ensure that over-cap batches for unknown/untabled models are blocked (raise `CostGuardrailBlocked`) rather than being allowed due to the reservation being skipped/<= 0.
Cost guardrails (cost_guardrails + daily_cap_usd) CostGuardrailBlocked blocking behavior = enforce - Operational
Add the requested conformance test: assert that an unknown-model batch reserves > 0, and that an over-cap unknown-model batch raises `CostGuardrailBlocked`. Also add coverage that the parallel-helper `model` argument can be steered to an unknown id.
Event History
Frequently Asked Questions
What is the severity of GHSA-j659-8xh6-5pq5?
The severity of GHSA-j659-8xh6-5pq5 is assessed as 45.
How do I fix GHSA-j659-8xh6-5pq5?
To fix GHSA-j659-8xh6-5pq5, you should update to the latest version of the atomic-agents-stack package.
What component is affected by GHSA-j659-8xh6-5pq5?
The GHSA-j659-8xh6-5pq5 vulnerability affects the `_estimate_batch_cost` function in the `atomic_agents/agent.py` file.
What is the cause of GHSA-j659-8xh6-5pq5?
GHSA-j659-8xh6-5pq5 is caused by the `_check_batch_reservation` function returning early when the price is 0.0 for models not present in the pricing table.
When was GHSA-j659-8xh6-5pq5 published?
GHSA-j659-8xh6-5pq5 was published on August 17, 2026.