A response parser treated missing nested fields as if they were populated. The advisory lists null or absent fields across several provider formats, and points out that extproc process termination can interrupt unrelated in-flight traffic when the failure mode is configured to deny requests. An upstream response must take one of the malformed shapes; the…
Inspect the ClaimsCase · DiggingBeagle record
Malformed provider responses could crash Agent Router extproc
Unexpected but successful-status AI provider response shapes reached nil-pointer handling.
Public disclosure: Nov 6, 2026
Scope
Agent Router extproc response parsing and shared-process failure domain prior to the 1.2.1 fix.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The first-party advisory identifies nil-dereference paths in malformed successful provider responses and a 1.2.1 repair. It does not document an actual provider attack or customer outage. An impact band remains unassigned because the available evidence does not establish a comparable severity score or verified numerical loss for this assessment.
Assessed Nov 8, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-AGENTROUTER-EXTPROC-NIL-RESPONSES-01 · Agent Router extproc crash on malformed provider responses · Agent Router version 1.2.1 release
At a glance
Validation of untrusted successful responses matters for availability as well as correctness, especially in shared AI gateways.
Read the implicationsAn upstream response must take one of the malformed shapes; the report does not establish a malicious provider attack, customer outage or remote arbitrary code execution.
Limits and uncertaintyFull account
A response parser treated missing nested fields as if they were populated. The advisory lists null or absent fields across several provider formats, and points out that extproc process termination can interrupt unrelated in-flight traffic when the failure mode is configured to deny requests.
An upstream response must take one of the malformed shapes; the report does not establish a malicious provider attack, customer outage or remote arbitrary code execution.
The failure occurs after an upstream response has already passed the HTTP success-status check. Null or omitted nested values in several AI-provider formats reached handlers that assumed a complete structure, allowing a failed parse to terminate the shared extproc process. The co-hosted MCP proxy makes the availability consequence wider than the one bad inference response. Rejecting malformed responses safely and separating process failure domains address different parts of that consequence.
Mechanism and trust boundary
- 01
Return a malformed HTTP 2xx provider response with absent required nested values.
- 02
Trigger a nil dereference inside extproc processing.
- 03
Interrupt other requests handled by the same process.
Claims & evidence
CLM-AGENTROUTER-EXTPROC-NIL-RESPONSES-01Several malformed HTTP 2xx responses from supported AI providers could cause nil-pointer dereferences in Agent Router extproc, disrupting AI inference and a co-located MCP proxy process.supported
Basis: reported finding
- supportsAgent Router extproc crash on malformed provider responsesprimary disclosure
Summary; affected provider response handlers; fix version
Implications
Validation of untrusted successful responses matters for availability as well as correctness, especially in shared AI gateways.
Controls and mitigations
- Upgrade Agent Router extproc to 1.2.1 and verify null or omitted nested fields from each supported provider return controlled errors without panics.
- Consider isolating the MCP proxy from any single malformed provider response failure so one request does not interrupt unrelated traffic.
Unknowns and contradictions
- An upstream response must take one of the malformed shapes; the report does not establish a malicious provider attack, customer outage or remote arbitrary code execution.
Sources and citation
Material revision history
- Nov 8, 2026 · Canonical change recorded · new in release · revision 229