CVE-2026-107295: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

Binding to localhost, the default, does not help, because a page open in the developer's browser can reach the loopback address. The endpoint accepted cross-site form-style requests since it never required Content-Type: application/json, and it parsed the body and ran the agent.

The attacker needs a page the developer opens while the UI is running, which is the user interaction in the vector. They can then drive the agent with a prompt of their choice. What follows depends on the tools the agent exposes: reading files, calling APIs with local credentials, writing data. Tools marked requires_approval=True are not protected either, because the endpoint trusts approval decisions that the client relays. The attacker's request can include those approvals.

This is a development tool, so exposure is highest on developer laptops with powerful tools and real credentials loaded.

Affected: pydantic-ai and pydantic-ai-slim from 1.34.0 up to 1.107.4, and from 2.0.0b1 up to 2.28.0, when you serve an agent through Agent.to_web() or clai web.

pip show pydantic-ai pydantic-ai-slim

Search your code and shell history for to_web( and clai web.

Upgrade to 1.107.4 on the 1.x line or 2.28.0 on the 2.x line. The chat endpoint now requires Content-Type: application/json and rejects other requests before parsing the body and before the agent runs.

The bundled chat UI already sends the header. Scripts or other non-browser clients that call the endpoint directly may need to send it.

If you cannot upgrade, don't run the web UI while browsing untrusted sites, stop it when idle, and don't serve an agent with side-effecting tools through it.

Check the web UI's request logs for chat requests with a Content-Type other than application/json or an Origin that is not your own UI. Review agent run logs and tool-call history for runs you did not start, and for side effects such as file changes or outbound calls from the tools. The advisory gives no log signature.

Summary

The Pydantic AI development web chat UI (Agent.to_web(), clai web) did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer's machine, causing the served agent to run and to execute its tools with the privileges and credentials of the local process.

Binding the web UI to localhost — the default — does not prevent this, because a page open in the developer's browser can reach the loopback address.

Impact

Applications and developers serving an agent through Agent.to_web() or clai web. The consequences depend on the tools the served agent exposes, and can include data disclosure as well as unwanted tool side effects. Tools marked requires_approval=True were not protected either, because the endpoint trusts approval decisions relayed by the client.

Mitigation

Upgrade to a patched version. The chat endpoint now requires Content-Type: application/json and rejects other requests before the request body is parsed and before the agent runs. The bundled chat UI already sends this header; scripts and other non-browser clients that call the endpoint directly may need to be updated to send it.

If you cannot upgrade, don't run the web UI while browsing untrusted sites, stop it when you aren't using it, and don't serve an agent with side-effecting tools through it.

Credits

• Thai Son Dinh from VinSOC Labs (R&D)