atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from…
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-770.
Summary
`_estimate_batch_cost` (`atomic_agents/agent.py`) looks up the per-model output price with `PRICING.get(model, {})`, returning 0.0 for any model not in the hardcoded pricing table. `_check_batch_reservation` then early-returns when the reservation is <= 0, skipping the batch reservation entirely. That reservation is the only defense against the documented fan-out race where every parallel helper/delegate reads the identical pre-batch on-disk cost total and each passes its individual check even though the collective spend overruns the configured cap. **Impact:** an operator running any model not in the pricing table (self-hosted/Ollama/vLLM, a new provider SKU) with `cost_guardrails` + `daily_cap_usd` set believes the cap protects them, but a single parallel batch can blow past the cap. The parallel-helper `model` argument can also be steered to an unknown id. The sibling `dream._estimate_dream_cost` does this correctly (`PRICING.get(model, _fallback_pricing())`), which makes this a clear defect. **Affected:** `agent.py` (`_estimate_batch_cost` / `_check_batch_reservation`), all versions through 1.0.0. **Fix:** use `PRICING.get(model, _costs._fallback_pricing())['output']` (mirror dream/calc_cost). Add a conformance test asserting an unknown-model batch reserves > 0 and that an over-cap unknown-model batch raises `CostGuardrailBlocked`.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | atomic-agents-stack (PyPI) | before 1.1.0 | 1.1.0 | Patch available | GHSA-j659-8xh6-5pq5 |
- atomic-agents-stack (PyPI) Vendor— Affected before 1.1.0 Fixed in 1.1.0 Patch available GHSA-j659-8xh6-5pq5
Remediation
- Fix · GHSA-j659-8xh6-5pq5 atomic-agents-stack (PyPI) Fixed in 1.1.0 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-j659-8xh6-5pq5
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences