What happened
NVD published CVE-2026-78250 (CVSS 4.3 Medium) on 2026-08-24, describing a remotely-triggerable infinite loop in Bytebot's agent execution workflow with a publicly available exploit report.
Why it matters
Illustrates the emerging 'agent-loop budget exhaustion' DoS pattern affecting early-stage autonomous agent frameworks, but the affected project's low maturity (v0.0.1) and DoS-only impact keep the practical blast radius small.
Attack vector
An unspecified function within Bytebot's Agent Execution Workflow component can be manipulated remotely to trigger an infinite loop, exhausting compute/budget resources (a step/loop-budget exhaustion DoS) without requiring authentication.
Affected systems
outlookgp/bytebot-ai bytebot 0.0.1
Mitigation
No patched version identified in the record; implement step/loop budget caps and execution timeouts as compensating controls until a fix ships.