Pydantic AI Harness nested CodeMode call tool-call-count limit bypass vulnerability
Pydantic AI Harness tool-call limit bypass in nested CodeMode calls
A GitHub security advisory disclosed that versions of Pydantic AI Harness before 0.59.0 did not enforce UsageLimits.tool_calls_limit on nested tool calls dispatched by run_code in the CodeMode toolset. A user or prompt-injected content could cause a program inside the sandbox to call tools via run_nested_call() without going through check_before_tool_call, thereby exceeding the limits set by operators for high-cost or side-effecting tools. The vulnerability is CVE-2026-114386 (GHSA-3589-pxp7-3gj8) and was fixed in 0.59.0.
The advisory describes the specific path by which nested tool calls bypass usage limits, which teams deploying Pydantic AI or configuring tool limits for agents can use to check their versions.