Pydantic AI 2.58 Closes Two Agent Boundary Gaps

What changed

Pydantic AI 2.58.0, released 20 October 2026, ships two medium-severity security fixes alongside a larger reliability release. GHSA-xv4x-g8mx-ch56 covers provider-native MCP telemetry: before 2.58.0, MCP server URLs, authorization tokens, custom headers, and URL-derived MCP identifiers could reach OpenTelemetry request traces even with include_content=False. GHSA-5pfm-2g3g-gh85 covers the Vercel AI and AG-UI adapters: with server-side message_history and the default manage_system_prompt='server', a client-submitted tool call could be executed during history reconstruction without a model request.

The release also adds run-wide timeout= and RunContext.deadline, per-request request_timeout and max_retries, delegated-task steering, compact step-store history, and several realtime and adapter fixes. The security changes are the dependable-agent story here because they constrain what crosses telemetry and UI-resume boundaries.

Directly verified

I checked the project release notes, both GitHub security advisories, and the published pydantic-ai-slim==2.58.0 wheel. The release notes identify both advisories and say the MCP issue is fixed in 2.58.0 and 1.107.8; the advisories list the affected ranges as <2.58.0 for MCP telemetry and 2.27.0 through 2.57.0 for the UI adapters. The wheel is a 2,335,238-byte py3-none-any artifact containing the shipped instrumentation and UI adapter modules. Source comparison from v2.57.0 to v2.58.0 shows new telemetry handling that redacts MCP URLs, authorization tokens, headers, and URL-derived identities before serialization.

This is release, advisory, wheel, and source inspection—not a live exploit reproduction, OpenTelemetry backend check, or AG-UI/Vercel end-to-end run. I did not establish that every custom adapter or downstream trace processor inherits the same protection.

Why it matters

Agent systems routinely treat traces and UI history as observability or presentation layers, but both can become durable data and execution boundaries. A trace that contains a bearer token is a credential store; a history adapter that trusts a client-shaped tool call is an execution path. The fixes make those boundaries narrower by default. Operators should still restrict historical trace access, rotate credentials that may have been exposed, upgrade both the runtime package and any split pydantic-ai-slim deployment, and test resume/history reconstruction with untrusted client input.

Bottom line: upgrade to 2.58.0 (or 1.107.8 for the v1 line) before treating MCP telemetry or UI history reconstruction as safe by default. The release closes two concrete paths; it is not a general security guarantee.