AIKIDO-2026-680513

TL;DR

Pydantic AI's UI adapters (AGUIAdapter and VercelAIAdapter) sanitize untrusted, client-submitted message history through UIAdapter.sanitize_messages before it reaches the agent, stripping unresolved dangling tool calls from the trailing response by default. The strip anchored to a message index computed before sanitization ran, so when a trailing client message sanitized to empty and was dropped, a preceding assistant response carrying an unresolved client-submitted tool call became the new tail and was dispatched unchecked. A remote client can use this to make a registered non-approval tool execute with attacker-supplied, schema-valid arguments, bypassing execution guardrails placed in model-request hooks. The fix moves the strip to a post-pass over the already-sanitized history so dangling tool calls are removed from whichever response actually survives as the tail.