CVE-2026-91987

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function, which returns a zero cost estimate for any model identifier not present in its pricing table (CWE-770, uncontrolled resource allocation). A low-privileged attacker who can configure deployments simply supplies an unknown model identifier, so estimated costs register as zero and daily cost caps never trigger, allowing budget limits to be exceeded via parallel batch operations. The impact is unbounded spend and resource consumption against the LLM provider (high availability impact per the CVSS 4.0 score of 7.1), with no direct confidentiality or integrity impact. Anyone relying on the framework's built-in cost guardrails in versions before 1.1.0 is affected. No public proof of concept exists, the issue is not in CISA's KEV catalog, and no exploitation is currently known.

What to do: Upgrade to atomic-agents-stack 1.1.0 or later, where unknown model identifiers no longer bypass cost estimation. Until upgraded, make the guardrail fail closed by rejecting or rate-limiting any batch job whose model is missing from the pricing table, and enforce hard spending caps at the LLM provider, account, or API-key level so runaway parallel batches cannot exceed budget regardless of the library's estimates. Audit billing and batch-run logs for jobs that used model identifiers outside the pricing table to detect prior cap bypasses.