AI & agent security · Reviewed security advisory
Your AI security control raised an alert. What did it actually stop?
PraisonAI and Pydantic AI advisories discussed in the 8 October brief make a practical point: verify the action a control prevents, and the destination a policy actually permits.
By Colin Ambani Njau ·
From the 8 October scheduler brief; these are earlier vendor advisories revisited this week.
First, correct the record
The PraisonAI maintainer’s GHSA-4r3p-w3mc-5v34 advisory says ordinary single- or double-vector prompt injections could be classified HIGH and passed through while blocking required CRITICAL. It lists versions through 4.6.77 as affected and 4.6.78 onward as patched.
The original scheduler brief assigned this description to CVE-2026-61439 with a high score. The maintainer’s advisory instead lists CVE-2026-62171 and moderate severity, with a 5.3 CVSS score. We use that directly checked record. The advisory was published in June; this article is a review prompted by this week’s brief, not a new October discovery.
The network policy needs the same scrutiny
Pydantic AI’s September advisory describes a blocked_domains bypass caused by different hostname interpretations between policy matching and resolution. It lists patched versions 1.107.6 and 2.44.0 for the relevant release branches and recommends allowed_domains where practical.
The documented issue does not bypass the separate private-IP or cloud-metadata protections described in that advisory. Keep the impact precise: a blocked domain could be reached through an equivalent representation, rather than unrestricted access to every internal destination.
A relatable way to think about enforcement
A warning light at a stockroom entrance helps only if someone, or a separate mechanism, stops an unauthorised entry. This is a business analogy. The same distinction applies to an agent: detection, approval and enforcement are different jobs.
Ask the owner to demonstrate a permitted request and a prohibited request. Then inspect the resulting tool action or network connection. Did the operation stop? Was an approval required? Did the destination match the policy after redirects and resolution? The answers should come from evidence, rather than the colour of a dashboard indicator.
Turn that question into a useful assessment
Use benign test content and controlled destinations. Record the configuration, software version, expected decision and observed side effect. If a request is blocked, retain enough evidence to show where it stopped. If it succeeds unexpectedly, record the scope of the failure without assuming a larger compromise.
Pentriarch supports assessment findings, evidence review and follow-up validation. Relevant MCP and agent tests have distinct coverage and availability conditions, documented below. This is an opportunity to test controls in an authorised environment; it is not a claim that Pentriarch supplies a runtime blocking layer or has repaired either vendor’s product.