Pydantic AI Harness before version 0.59.0 does not enforce the UsageLimits.tool_calls_limit when nested tool calls are generated from the CodeMode run_code tool. The flaw allows a user or injected prompt to trigger run_nested_call() without the usual check_before_tool_call verification, permitting the sandboxed program to issue an unlimited number of calls to costly or side‑effecting tools. This uncontrolled consumption of resources matches CWE‑770 and could lead to denial of service or unintended execution of privileged operations.

The vulnerability affects any deployment of pydantic's Pydantic AI Harness with a version less than 0.59.0. All releases before the official 0.59.0 tag inherit the flaw, including internal releases that have not been updated to the latest release. The software is available on PyPI (pydantic-ai-harness) and can be installed or upgraded via standard package managers.

The CVSS score of 6.3 indicates medium severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be an attacker who can supply content to the AI harness—such as through authenticated API calls or prompt injection—because the flaw is triggered by crafted input to run_code. Once triggered, the harness can repeatedly dispatch nested calls, leading to excessive resource consumption or privileged tool invocation.