Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-10-08

HighVendor post

Hostile Web Pages Could Drive Loopback Pydantic AI Agents and Execute Their Tools

Two Pydantic AI web-chat flaws let hostile browser pages reach loopback agents, submit instructions, and trigger tools with local process privileges.

Pydantic AITool execution / MCPControlled browser-to-agent attacks against loopback Pydantic AI development chat serversDeveloper machines running Pydantic AI Agent.to_web() or clai web with consequential agent tools exposed

What happened

In controlled attack paths, a hostile website reached a loopback Pydantic AI chat server, submitted instructions to the served agent, and caused it to run configured tools with the local process's privileges and credentials.

Why it matters

Potential local data disclosure and unwanted tool side effects under the developer process's credentials. Actual impact depends on which tools the developer exposed; no production victim or in-the-wild exploitation was reported.

Missing authorization check

An independently authenticated decision bound to the exact tool, arguments, principal, and target before a browser-originated agent run can produce a consequential effect.

Would PP block it?

Permission Protocol could separate authority from the compromised browser session and require a signer or policy to approve the resolved tool action. It would not stop DNS rebinding or cross-site requests from reaching the local chat server, and uninstrumented local effects would remain possible.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-10-08

    Pydantic publishes GHSA-h4xc-3qfq-jf93 and fixes the missing content-type validation in versions 1.107.4 and 2.28.0.

  2. 2026-10-08

    Pydantic publishes GHSA-q2xc-rrxj-58x9 and fixes Host-header validation in versions 1.107.5 and 2.30.0.

Technical breakdown

  • The Agent.to_web() and clai web chat server listened on loopback but accepted browser-reachable chat requests.
  • In CVE-2026-107295, missing content-type validation let a hostile site submit a browser-compatible request that started an agent run.
  • That endpoint trusted approval decisions relayed by the client, so tools marked requires_approval were not protected from the hostile browser path.
  • In CVE-2026-107292, missing Host-header validation let an attacker-controlled hostname rebind to loopback and interact with the local chat UI as a same-origin service.
  • The resulting agent could execute configured tools with the privileges and credentials of the local process; consequences depended on the exposed tools.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Immediately before each served-agent tool invocation, after resolving the tool name, arguments, target, and acting principal
Still needs
Permission Protocol does not validate Host or Content-Type headers, secure loopback services, prevent a developer from visiting a hostile page, or contain arbitrary local code. Patching Pydantic AI and limiting development-server tools remain necessary.
Receipt required for
Executing a consequential local tool call with the exact tool, arguments, target, principal, policy, and expiry

A Tool-Call Gate outside the browser-relayed chat approval path could reject tool calls that lack a valid grant for the exact action and target, including calls generated from attacker-submitted chat input.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop