Industry story
Pydantic AI v2.28.0 patches high-severity CSRF vulnerability in dev web UI
agent-framework guardrails reliability security
Pydantic AI released v2.28.0 on August 11, 2026, addressing a high-severity security flaw in its development web chat interface (Agent.to_web() / clai web). The vulnerability allowed a cross-origin request from any website open in a developer's browser to reach the agent's chat endpoint without triggering a CORS preflight check. A malicious site could silently cause the local agent to run and execute its tools using the developer's own credentials and system privileges. The fix requires all requests to include a Content-Type: application/json header, rejecting anything else before the body is parsed or the agent executes. The patch is also backported to v1.107.3.
Full analysis
Pydantic AI released v2.28.0 on August 11, 2026, addressing a high-severity security flaw in its development web chat interface (Agent.to_web() / clai web). The vulnerability allowed a cross-origin request from any website open in a developer's browser to reach the agent's chat endpoint without triggering a CORS preflight check. A malicious site could silently cause the local agent to run and execute its tools using the developer's own credentials and system privileges. The fix requires all requests to include a Content-Type: application/json header, rejecting anything else before the body is parsed or the agent executes. The patch is also backported to v1.107.3.
Comments