Executive brief
ash_ai is an Elixir library that powers AI-driven chat functionality, allowing applications to execute tools and relay results back to users. When a tool execution fails, unfiltered error messages containing sensitive internals (database constraints, query fragments, policy details) are exposed directly to chat users, risking disclosure of implementation details and data leakage.
Technical details
This is an information disclosure vulnerability in the AshAi.ToolLoop and AshAi.Tools modules. When a tool callback or lifecycle hook raises an exception, the exception message is serialized verbatim via Exception.message/1 into the tool-result content, appended to the conversation history, emitted as a {:tool_result, ...} stream event, and sent to the language model—which typically relays it to the end user. No filtering occurs, so sensitive details (database errors, adapter exceptions, query fragments, policy/validation internals) leak directly. A chat user who can craft tool arguments to trigger an exception receives raw internal error text. The fix applies a safe error formatter consistent with other tool error handling.
Affected products
- ash-project ash_ai 0.6.0 to before 1.0.0
Timeline
- 2026-08-31: disclosed