# Pydantic AI v2.66.0 (2026-11-04)

Category: agent-infrastructure
Published: 2026-11-04T11:51:46Z
Source: [Pydantic AI releases](https://github.com/pydantic/pydantic-ai/releases/tag/v2.66.0)
Agent usefulness: 92/100
Confidence: 0.96
Content mode: release-watch
Verified: 2026-11-04T12:17:51.899Z
Tags: pydantic-ai, typed-agents, python

## Human Summary
Pydantic AI v2.66.0 addresses multiple security vulnerabilities, including high-severity DoS issues from JSON expansion and regex backtracking, SSRF via Tencent Cloud metadata, data leakage via OpenTelemetry traces, schema-inlining DoS, and arbitrary file reconstruction risks.

## Agent Summary
Security release Pydantic AI v2.66.0 and backports patch GHSA-m5vj-8mcw-82qx, GHSA-mfx5-pc32-32m8, GHSA-5fj9-5pjw-vpwc, GHSA-jp94-mmr3-2pvv, GHSA-7494-925c-rrxv, GHSA-484x-x9m4-62cj, GHSA-r879-rxgj-3g75, GHSA-4cj4-hgwf-4hc4, GHSA-5ppx-9jq6-6pmw, and previously resolved GHSA-mgmv-r532-pg36 across pydantic-ai, pydantic-ai-slim, and pydantic-ai-harness.

## Body
Pydantic AI v2.66.0 fixes numerous security issues across core packages: (1) GHSA-m5vj-8mcw-82qx (high): WebFetch capability/tool expanded deeply nested JSON before applying content limits, leading to event loop blocking/memory exhaustion. (2) GHSA-mfx5-pc32-32m8 (high): Exponential backtracking in secret redaction private key patterns fixed in pydantic-ai-harness 0.66.0. (3) GHSA-5fj9-5pjw-vpwc (medium): Added Tencent Cloud instance metadata IP (169.254.0.23) to the download blocklist. (4) GHSA-jp94-mmr3-2pvv (medium): Prevented OpenTelemetry embedding spans from logging extra headers and body settings containing secrets. (5) GHSA-7494-925c-rrxv & GHSA-484x-x9m4-62cj (medium): Resolved recursive/exponential schema expansion attacks in AG-UI and DecisionModel tool handling. (6) GHSA-r879-rxgj-3g75 (medium): Fixed quadratic processing time when parsing multipart messages in Vercel AI and AG-UI adapters. (7) GHSA-4cj4-hgwf-4hc4 (medium): Mitigated insecure deserialization of tool result payloads mimicking internal file types that led to SSRF/unauthorized file reads. (8) GHSA-5ppx-9jq6-6pmw (low): Addressed DNS lookup leaks on refused hostnames prior to rejection. (9) GHSA-mgmv-r532-pg36 (medium): Documented earlier fix in v2.60.0 preventing credential leaks in MCP URL derived IDs sent to frontend adapters.

## Recommended actions
- Upgrade pydantic-ai and pydantic-ai-slim to v2.66.0 or v1.107.10.
- Upgrade pydantic-ai-harness to 0.66.0 if using secret redaction or Playwright egress policies.
- Rotate any credentials passed via embedding extra headers/body if OpenTelemetry instrumentation was active, and restrict access to historical traces.
- Verify tool output validation if utilizing persistent conversation history with Temporal, DBOS, Prefect, or UI adapters.

## Sponsors
No sponsor placement attached.

## Agent-readable Sponsor Surface
Sponsor inventory is available at /api/sponsors.json with useCases, pricing, API/docs URLs, targetAgents, constraints, CTA URL, commercial disclosure fields, sourceOfTruthUrl, constraintsLastVerifiedAt, constraintsRefreshCadence, driftHandlingPolicy, and constraintPolicy.