Executive brief
atomic-agents-stack is a framework for building AI agent systems with cost controls. Organizations using this library with self-hosted or custom AI models (e.g., Ollama, vLLM) and cost guardrails enabled believe their daily spending limit will prevent budget overruns. However, a defect in cost estimation allows multiple parallel batch requests to bypass the daily cap entirely, potentially causing unexpected cloud costs or operational impacts if running against paid APIs.
Technical details
The vulnerability exists in `atomic_agents/agent.py` in the `_estimate_batch_cost()` and `_check_batch_reservation()` functions. When a model is not found in the hardcoded `PRICING` dictionary, the code returns 0.0 as the estimated cost, which causes `_check_batch_reservation()` to early-return without enforcing the cost reservation. The batch reservation is the only defense against a documented fan-out race condition where multiple parallel helpers/delegates each read the same pre-batch cost total and individually pass the cost check, but collectively exceed the cap. An attacker (or misconfigured operator) can use an unknown or self-hosted model ID to trigger this condition. The root cause is inconsistent handling compared to the working sibling function `dream._estimate_dream_cost()`, which correctly calls `PRICING.get(model, _fallback_pricing())`. The fix is to apply the same fallback pattern and add conformance tests validating cost reservation and guardrail enforcement for unknown models. A patch was released in version 1.1.0.
Affected products
- dep0we atomic-agents-stack <= 1.0.0
Timeline
- 2026-06-10: disclosed: GitHub Security Advisory GHSA-j659-8xh6-5pq5 published
- 2026-06-10: patched: Fix released in version 1.1.0
- 2026-08-17: advisory: Advisory updated/reviewed by GitHub