CVE-2026-91987 Overview
CVE-2026-91987 affects atomic-agents-stack versions prior to 1.1.0. The flaw resides in the _estimate_batch_cost function, which returns a zero cost value when it encounters model identifiers absent from its internal pricing table. Attackers with configuration access can supply arbitrary model names to bypass daily cost caps and exceed budget limits during parallel batch operations. The issue is classified under CWE-770: Allocation of Resources Without Limits or Throttling.
Critical Impact
Attackers can bypass cost-based guardrails and drive uncapped resource consumption against AI batch pipelines, resulting in denial of budget and potential service disruption.
Affected Products
- atomic-agents-stack versions before 1.1.0
- Deployments relying on _estimate_batch_cost for daily cost cap enforcement
- Parallel batch orchestration workflows using unvalidated model identifiers
Discovery Timeline
- 2026-09-15 - CVE-2026-91987 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91987
Vulnerability Analysis
The vulnerability is a business logic flaw in the cost-estimation path of atomic-agents-stack. The _estimate_batch_cost function looks up per-model pricing from a static table and returns zero when a requested model identifier is not present. Downstream guardrail logic treats that zero value as a legitimate low-cost estimate rather than a lookup failure. As a result, daily cost caps and per-batch budget limits are never triggered for unknown models.
Because the estimator gates parallel batch execution, an attacker who controls model configuration can dispatch an unbounded number of requests. This translates into uncontrolled resource consumption against the underlying model providers and any downstream infrastructure.
Root Cause
The root cause is missing input validation combined with an unsafe default. The pricing lookup silently returns 0 for unrecognized keys instead of raising an error or rejecting the batch. This design assumes all model identifiers reaching the guardrail are known and priced, which is not enforced upstream.
Attack Vector
An authenticated user with permission to configure agent deployments supplies a fabricated or newly released model identifier not present in the pricing table. The estimator computes a zero cost, the guardrail approves the batch, and parallel execution proceeds without cap enforcement. Repeated invocations amplify the resource-exhaustion impact against provider quotas and billing.
No verified exploit code is published. See the GitHub Security Advisory GHSA-j659 and the VulnCheck Advisory for Cost Guardrail Bypass for advisory-level details.
Detection Methods for CVE-2026-91987
Indicators of Compromise
- Batch execution logs referencing model identifiers that do not appear in the atomic-agents-stack pricing table.
- Cost-estimation records showing 0 or near-zero estimates immediately preceding large-volume batch dispatches.
- Unexpected spikes in upstream model provider billing or API quota consumption not reflected in internal cost dashboards.
Detection Strategies
- Compare model identifiers referenced in agent configurations against the known pricing table and alert on mismatches.
- Correlate guardrail-approved batches with actual provider-side token or request counts to surface underestimated jobs.
- Alert on any invocation of _estimate_batch_cost that returns 0 while dispatching more than a defined threshold of parallel requests.
Monitoring Recommendations
- Continuously monitor upstream AI provider billing APIs and reconcile against internal guardrail estimates.
- Track configuration changes to agent deployments, particularly changes to the model field, in an audit log.
- Set independent budget alerts at the cloud or provider level so cost overruns are caught even when application-layer guardrails fail.
How to Mitigate CVE-2026-91987
Immediate Actions Required
- Upgrade atomic-agents-stack to version 1.1.0 or later on all deployments.
- Audit existing agent configurations for model identifiers not present in the pricing table and remove or replace them.
- Enforce provider-side spending limits as a compensating control until the patched version is deployed.
Patch Information
The maintainers addressed the flaw in atomic-agents-stack 1.1.0. Refer to the GitHub Security Advisory GHSA-j659 for fix details and the VulnCheck Advisory for Cost Guardrail Bypass for exposure guidance.
Workarounds
- Wrap _estimate_batch_cost so that unknown models raise an exception or return a conservative maximum cost value instead of 0.
- Restrict configuration privileges to a small set of trusted operators and require review for any new model identifier.
- Add an allowlist of approved model identifiers and reject batch submissions that reference any model outside the list.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
