pydantic-ai v2.58.0 — v2.58.0 (2026-10-19)

From the Daily Brief

pydantic-ai 2.58.0 fixes two medium-severity advisories. The first concerns MCP request telemetry: when tracing was enabled, the library recorded MCP server URLs, tokens and headers in OpenTelemetry spans. Upgrading stops new leaks but does nothing about traces already stored, so the release notes advise restricting access to existing traces and rotating the exposed tokens. The second advisory covers the Vercel AI and AG-UI UI adapters, which could execute tools with arguments chosen by the client rather than by the model's own tool call. That is a direct path from a browser to tool execution. The release also includes Temporal mitigation steps and compatibility notes. Teams running pydantic-ai agents behind a web front end, or shipping traces to a shared observability backend, are the ones exposed, and for them the trace store is now a credential store that needs the same access review.

Read the 2026-10-20 Brief →

Context

The change in Pydantic AI 2.58.0 that most needs is a security fix for apps that serve an agent to a web frontend through its Vercel AI or AG-UI adapters (advisory GHSA-5pfm-2g3g-gh85). These adapters accept chat history sent by the browser. A client could shape that history so that the agent ran one of its tools with arguments the client chose, without ever asking the model. That meant the model could not refuse the call, and attached to model requests never saw it. The exposure applied to versions 2.27.0 through 2.57.0, and only when the app also passed its own server-side message history and kept the default server-managed . Version 1 is not affected.

The impact has firm limits. Arguments are still validated against the tool's schema. Tools that require approval are not run this way. Checks inside the tool function itself, or in the `before_tool_execute` , still apply. The advisory notes that a client can often get the same effect simply by prompting the model. The apps at real risk are those that relied on the model's judgment, or on model-request hooks, to decide how a tool without approval gets called. Until upgrading, the advisory recommends enforcing authorization inside each tool against the authenticated user. The same release fixes a second medium-severity issue, in which MCP server URLs, tokens and headers could appear in OpenTelemetry traces. For that one, the release notes advise restricting access to old traces and rotating exposed credentials.

Key takeaways · AI-distilled

The MCP telemetry advisory (GHSA-xv4x-g8mx-ch56) leaked server URLs, auth tokens and custom headers into OpenTelemetry traces even with include_content=False. It is fixed in 2.58.0 and 1.107.8.
Temporal users get a specific mitigation: URL-based MCP activity names stay unchanged to protect in-flight workflows, so once those finish, pass an explicit id= to MCP, which renames the activities.
The UI-adapter flaw (GHSA-5pfm-2g3g-gh85) needed non-empty server-side message_history with manage_system_prompt='server', the default. Approval-required tools were not executed through that path, and v1 is unaffected.
DBOS users should note that Planning status events now emit after store reads; existing workflows using Planning with an event_stream_handler may not recover after upgrading, so let in-flight runs finish or deploy a new app version.
New run controls include a whole-run timeout= with RunContext.deadline, ModelSettings max_retries and request_timeout, and an UnsupportedSettingWarning when a model ignores such a setting.

Terms in this piece · Glossary

attention — The mechanism that lets a model weigh which earlier words matter for the word it's currently processing — the core operation of a transformer.
guardrails — The checks around a model that block bad inputs and outputs — filters, validators, and permission rules the model itself can't override.
system prompt — The standing instructions a model receives before any user input — defining its role, rules, tools, and tone for the whole conversation.
agent hook — A script the harness runs automatically at a fixed point in an agent's loop — before a tool call, after an edit, on session start.