What happened
Seed-verified (VulnCheck advisory, published Oct 21): the UsageLimits.tool_calls_limit enforcement is bypassed for nested tool calls dispatched from run_code, letting constrained execution exceed operator-set limits.
Why it matters
Agent-harness budget controls are a core guardrail for cost/safety; a bypass means prompt-injected code can keep invoking tools past the operator's cap in sandboxed agent deployments.
Attack vector
A user or prompt-injected sandboxed program uses run_code to call tools recursively via run_nested_call(), which skips the check_before_tool_call path, defeating the configured tool_calls_limit.
Affected systems
Pydantic AI Harness < 0.59.0 (CodeMode toolset)
Mitigation
Upgrade to Pydantic AI Harness 0.59.0+; monitor and bound nested tool dispatch outside the sandbox.