Executive brief
atomic-agents-stack is a Python library for building AI agent systems that enforces daily spending caps on language model API calls. A flaw in the cost estimation logic returns zero cost for unknown or custom models, allowing attackers to bypass daily budget limits by configuring parallel batch operations with unrecognized model identifiers, potentially causing runaway cloud spending.
Technical details
The vulnerability is a resource exhaustion issue (CWE-770) in the _estimate_batch_cost function within agent.py. The function uses PRICING.get(model, {}) to look up per-model output costs, returning 0.0 for any model absent from the hardcoded pricing table. Downstream logic in _check_batch_reservation treats zero reservations as valid and skips the cost guardrail check entirely. An attacker who can control the model parameter in parallel batch operations can pass unknown model identifiers, causing cost guards to be bypassed. This is particularly dangerous because the sibling _estimate_dream_cost function correctly implements fallback pricing, making this a clear logic error. The vulnerability affects all versions up to and including 1.0.0; version 1.1.0 and later patch the issue by using PRICING.get(model, _costs._fallback_pricing()) instead.
Affected products
- atomic-agents-stack atomic-agents-stack before 1.1.0
Timeline
- 2026-06-10: disclosed: GitHub Security Advisory GHSA-j659-8xh6-5pq5 published
- 2026-09-15: advisory: CVE-2026-91987 assigned and published on NVD
- 2026: patched: Fix available in version 1.1.0