{"uuid": "4ce7d19a-099f-4a47-82de-99ea80ad9ae7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-j659-8xh6-5pq5", "type": "seen", "source": "https://gist.github.com/alon710/10698dbbc358e681dffa6e3a9906a312", "content": "# GHSA-J659-8XH6-5PQ5: GHSA-J659-8XH6-5PQ5: Financial Guardrail Bypass in atomic-agents-stack via Parallel Execution of Unlisted Models\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-17\n> **Full Report:** https://cvereports.com/reports/GHSA-J659-8XH6-5PQ5\n\n## Summary\nA high-severity vulnerability in the atomic-agents-stack framework allows complete bypass of cost-cap guardrails during parallel model execution when utilizing unlisted, local, or self-hosted models.\n\n## TL;DR\nUnrecognized LLMs evaluate to a $0.00 reservation cost, completely bypassing batch cost guardrails and allowing infinite execution spend.\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network\n- **CVSS v4 Score**: 8.7\n- **Exploit Status**: Proof of Concept Available\n- **CISA KEV Status**: Not Listed\n- **Affected Components**: atomic_agents/agent.py\n\n## Affected Systems\n\n- atomic-agents-stack\n- **atomic-agents-stack**: <= 1.0.0 (Fixed in: `1.1.0`)\n\n## Mitigation\n\n- Upgrade atomic-agents-stack to 1.1.0 or higher\n- Manually inject custom pricing definitions into the _costs.PRICING registry at application initialization\n\n**Remediation Steps:**\n1. Identify the current installed version of atomic-agents-stack using command line checks.\n2. Upgrade the package using standard package managers (pip install --upgrade atomic-agents-stack>=1.1.0).\n3. Verify installation of the patched version by executing import assertions.\n4. For systems unable to upgrade, configure a startup script to manually inject custom model metadata into the PRICING dictionary.\n\n## References\n\n- [GitHub Security Advisory GHSA-j659-8xh6-5pq5](https://github.com/advisories/GHSA-j659-8xh6-5pq5)\n- [Repository Advisory Details](https://github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-j659-8xh6-5pq5)\n- [Project GitHub Release Notes (v1.1.0)](https://github.com/dep0we/atomic-agents-stack/releases#release-v1.1.0)\n- [Source Code Repository](https://github.com/dep0we/atomic-agents-stack)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-J659-8XH6-5PQ5) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-18T10:31:34.358155Z"}