Pydantic AI versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not including 2.5.0 contain an authorization flaw in the UI adapters (AG-UI and Vercel AI). The sanitization process removes unresolved client tool calls based on a message index computed before sanitization, which can cause a preceding assistant response with an unresolved tool call to be dispatched without inspection. Consequently, a remote client can cause a registered, non-approval server tool to execute with client-supplied arguments instead of model-generated ones. This bypasses model-request hooks that normally gate tool execution. Tools requiring approval are not auto-executed via this path. The issue is fixed in versions 1.107.1 and 2.5.0.

An attacker can remotely cause execution of registered server tools with arbitrary client-supplied arguments, bypassing model-generated argument validation and model-request hook protections. The impact depends on the functionality of the affected tools. Tools requiring explicit approval are not affected by this bypass. There is no indication of known exploits in the wild.

Upgrade to pydantic-ai versions 1.107.1 or later, or 2.5.0 or later, where this issue is fixed. No other mitigation or temporary workaround is documented. Patch status is not explicitly stated but the fix versions are known; therefore, updating to these versions is recommended.