Affected version
Reports that share this version, grouped in one feed.
The credit card detector in PIIMiddleware uses a regex that only matches 16-digit card numbers, so valid 13-15 digit cards (Amex, Diners Club, legacy Visa) pass through undetected, potentially leaking PII to the model.
The PII detectors for email, IP, and MAC addresses use \b word boundaries which are Unicode-aware. Non-ASCII letters (CJK, Cyrillic, Arabic, accented Latin) are treated as word characters, so the boundary does not trigger between them and an ASCII PII token. This allows PII to pass through unredacted, unblocked, or unmasked.
A before_model middleware hook configured with can_jump_to=["model"] that returns {"jump_to":"model"} crashes create_agent at runtime with KeyError because the conditional edge path map omits the hook's own node name, even though the router resolves "model" to it.
When env is not provided to ShellToolMiddleware, _create_resources coerces None to an empty dict, causing host and Codex shell sessions to lose parent environment variables such as PATH, proxy settings, and credentials.
An edit decision can change a tool call from tool A to tool B, but the resulting call is evaluated only against tool A's InterruptOnConfig. If tool B has its own interrupt_on policy, it is silently skipped, allowing execution without the required human approval.
On Windows, FilesystemFileSearchMiddleware returns virtual paths containing native backslashes (e.g., '/src\\nested\\example.py') instead of the contract's forward-slash format, causing inconsistent and non-portable tool outputs.
When `HumanInTheLoopMiddleware` is configured with an `InterruptOnConfig` that includes an explicit `args_schema`, the generated `ReviewConfig` in the interrupt payload omits that schema. This is a silent configuration failure: the schema is accepted but not propagated, preventing schema-driven client-side handling.