Two protocol transports advertised the same event schema, but only SSE passed decoded values through its validator in the tested @ag-ui/client 0.0.58 build. The example malformed event creates an inconsistent active-message state and prevents clean run completion. The public thread was later closed with a maintainer statement that binary validation was…
Inspect the ClaimsCase · DiggingBeagle record
AG-UI protobuf events bypassed SSE schema checks before the project reported a repair
A reporter demonstrated malformed AG-UI protobuf events passing into client state while the same event over SSE was rejected; maintainers later said the binary path was fixed on main.
Scope
Issue closed and maintainer reports fix on main; no independently confirmed tagged-release version or production exploit.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
The pinned Claim and its primary disclosure support the described controlled result, but do not establish a population-wide rate or calibrated impact. The source is primary to the described analysis, not independent replication of every outcome. Impact remains unbanded because no calibrated impact rubric for this particular evidence is established.
Assessed Nov 2, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV02-AGUI-PROTOBUF-VALIDATION-A · AG-UI protocol issue 2524: protobuf event schema parity
At a glance
Transport parity requires identical validation after decoding; client state must not trust a wire format merely because it was parsed.
Read the implicationsIssue closed and maintainer reports fix on main; no independently confirmed tagged-release version or production exploit. A fixed tagged package version and independent before-and-after reducer test are not established in the source material.
Limits and uncertaintyFull account
Two protocol transports advertised the same event schema, but only SSE passed decoded values through its validator in the tested @ag-ui/client 0.0.58 build. The example malformed event creates an inconsistent active-message state and prevents clean run completion. The public thread was later closed with a maintainer statement that binary validation was added; therefore this is a historical defect with patch confirmation on main, not an unresolved November zero-day.
This is a transport-consistency failure, not evidence that every protobuf event is malicious. The test submitted an event with a numeric messageId; the SSE route rejected it through the event schema, whereas the binary decoder passed its result to a state reducer. The September 21 maintainer response says both transports now validate at the same shared reader boundary and closes the issue as fixed. That establishes a reported source-level correction, but not the earliest released package containing it. Any reproduction or version advice must distinguish the tested 0.0.58 build from the eventual fixed release.
Mechanism and trust boundary
- 01
Deliver an event over protobuf
The client selects the binary decoder by content type.
Boundary: Remote event bytes into protocol decoder
- 02
Skip shared schema parsing
Malformed message fields are accepted on binary transport but rejected by SSE.
Boundary: Decoder result into assumed schema authority
- 03
Corrupt reducer state
An invalid message ID can leave a synthetic active message and block RUN_FINISHED.
Boundary: Unvalidated event into client run state
Claims & evidence
CLM-2026-NOV02-AGUI-PROTOBUF-VALIDATION-AThe AG-UI issue reproduced a numeric messageId passing through protobuf decoding and disrupting reducer completion while equivalent SSE input was rejected by EventSchemas.parse; a September maintainer comment reports correction on main.supported
Basis: reported finding
- supportsAG-UI protocol issue 2524: protobuf event schema parityprimary disclosure
Issue 2524, transport comparison and Sep 21 maintainer resolution
CLM-2026-NOV02-AGUI-PROTOBUF-VALIDATION-BA maintainer closed the protobuf-validation issue as fixed on main and described shared transport-parity tests, without identifying a tagged release in the cited comment.supported
Basis: reported finding
- supportsAG-UI protocol issue 2524: protobuf event schema parityprimary disclosure
Issue 2524, September 21 maintainer comment closing as fixed and transport-parity.test.ts
Implications
Transport parity requires identical validation after decoding; client state must not trust a wire format merely because it was parsed.
Controls and mitigations
- Apply the same EventSchemas.parse at every decoded-event boundary and verify fixed release versions before upgrading field guidance.
- Run the same malformed-event fixture through SSE and protobuf and require identical validation verdicts before allowing either transport to modify the shared reducer.
Unknowns and contradictions
- Issue closed and maintainer reports fix on main; no independently confirmed tagged-release version or production exploit.
- A fixed tagged package version and independent before-and-after reducer test are not established in the source material.
Sources and citation
Material revision history
- Nov 2, 2026 · Canonical change recorded · new in release · revision 214