Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Evidence record / unreal-agent

A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.

2026-10-13-unreal-agent-v0-3-1-refreshes-harbor-s-pyjwt-lock-to-include-parser-key-validation-and-jwks-redirect

v0.3.1 refreshes Harbor’s PyJWT lock to include parser, key-validation and JWKS redirect fixes. Harbor’s Python lock now selects PyJWT 2.15.0, including security changes from 2.14.0 and 2.15.0. CVE-2026-101918 / GHSA-42vr-xj54-vc7v, published 2026-09-30, concerns deeply nested payload JSON raising an uncaught RecursionError in pre-verification parsing paths through 2.14.0; 2.15.0 wraps it in DecodeError. The confirmed impact is a failed call, potentially an HTTP 500, not demonstrated process termination or persistent exhaustion. GHSA-pxh4-856f-4h89 rejects empty symmetric JWKs in 2.14.0; through 2.13.0 an application trusting such a key can accept an attacker-forged token. CVE-2026-102267 / GHSA-9v7f-9g4p-ffgj is fixed in 2.14.0: an attacker-influenced redirect from the configured trusted JWKS endpoint can disclose caller headers or substitute trusted signing keys; a token key ID alone is insufficient. CVE-2026-102275 / GHSA-x33g-cr3x-6449, published 2026-10-05, is fixed in 2.15.0: inconsistent public x and private d fields in an OKP JWK create key-identity confusion. A stolen-token bypass additionally requires a DPoP application to accept private key parameters contrary to RFC 9449. No such integration was established in this agent. These are benchmark dependencies, not fixes to its Go Codex credential loader.

Channel: tagged-release. Half: defect. Date: 2026-10-06.

Operator consequence: Refresh the Harbor environment from the released lock, then inspect any authentication integration for the advisory conditions. Keep the benchmark dependency update separate from runner failure and credential-handling work. No harness exploitability was demonstrated.

Receipt

Finding metadata

Confidence
high

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-unreal-agent-v0-3-1-refreshes-harbor-s-pyjwt-lock-to-include-parser-key-validation-and-jwks-redirect

Profile citations

Source links

Primary links, including exact changelog lines when available.

  1. Unreal Agent
    commit2026-10-13-unreal-agent-v0-3-1-refreshes-harbor-s-pyjwt-lock-to-include-parser-key-validation-and-jwks-redirectgithub.com/unreallabsai/unreal-agent/commit/b7203ca337a399635c29ce610f8cf1d1bda803aetagged commit file2026-10-13-unreal-agent-v0-3-1-refreshes-harbor-s-pyjwt-lock-to-include-parser-key-validation-and-jwks-redirectunreallabsai/unreal-agent / benchmarks/harbor/uv.locktagged commit file2026-10-13-unreal-agent-v0-3-1-refreshes-harbor-s-pyjwt-lock-to-include-parser-key-validation-and-jwks-redirectjpadilla/pyjwt / CHANGELOG.rstofficial docs2026-10-13-unreal-agent-v0-3-1-refreshes-harbor-s-pyjwt-lock-to-include-parser-key-validation-and-jwks-redirectgithub.com/advisories/GHSA-42vr-xj54-vc7vofficial docs2026-10-13-unreal-agent-v0-3-1-refreshes-harbor-s-pyjwt-lock-to-include-parser-key-validation-and-jwks-redirectgithub.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89official docs2026-10-13-unreal-agent-v0-3-1-refreshes-harbor-s-pyjwt-lock-to-include-parser-key-validation-and-jwks-redirectgithub.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgjofficial docs2026-10-13-unreal-agent-v0-3-1-refreshes-harbor-s-pyjwt-lock-to-include-parser-key-validation-and-jwks-redirectgithub.com/advisories/GHSA-x33g-cr3x-6449

Versioned source: run artifact