THE HYPE KEVIN / SECURITYOCTOBER 21 AND 22, 2026

SIX TOOLS / THE FULL RECORD

Round 2: fresh bugs

Round 2: fresh bugs

curl

A use after free leaves a dangling transfer reference.

CVE-2026-92392

CWE-416

Functions the fix touched:

  • multi_done (primary)

pydantic-ai

Leaked concurrency slots can stop new requests.

CVE-2026-107286

CWE-772

Functions the fix touched:

  • ConcurrencyLimitedModel.request_stream (primary)
  • ConcurrencyLimiter.__init__ (primary)
  • ConcurrencyLimiter.release (primary)
  • ConcurrencyLimiter.acquire (secondary)
  • ConcurrencyLimitedModel.request (secondary)
  • ConcurrencyLimitedModel.count_tokens (secondary)
  • ConcurrencyLimitedModel.compact_messages (secondary)
  • _PreparedAgentRun.open (secondary)
  • _prepare_request (secondary)

fast-jwt

Skipped signature checks can let forged tokens pass.

CVE-2026-107720

CWE-347;CWE-20

Functions the fix touched:

  • createVerifier (primary)

seroval

Unsafe deserialization can invoke a callable.

CVE-2026-104846

CWE-843

Functions the fix touched:

  • deserializePromise (primary)
  • deserializePromiseResolve (primary)
  • deserializePromiseReject (primary)
  • deserialize (secondary)

datamodel-code-generator

Path traversal can write files outside the intended directory.

CVE-2026-107377

CWE-22;CWE-73

Functions the fix touched:

  • _ProtoInputPreparer._write_missing_weak_imports (primary)
  • _ProtoInputPreparer.__enter__ (secondary)
Completed, stopped and unrun scans are shown apart.
TargetClaude Code's security plugin/security-reviewCodex SecurityPlain Claude CodePlain CodexSemgrep
curlnot runnot runskipped for budgetnot runrun1: stopped by OpenAI's safeguard
run2: stopped by OpenAI's safeguard
run3: stopped by OpenAI's safeguard		run1: missed
run2: missed
run3: missed
pydantic-ainot runnot runstopped at a cost cap, no reportnot runrun1: missed
run2: missed
run3: missed		run1: missed
run2: missed
run3: missed
fast-jwtrun1: caughtrun1: missedrun1: caughtrun1: caughtrun1: stopped by OpenAI's safeguard
run2: stopped by OpenAI's safeguard
run3: stopped by OpenAI's safeguard		run1: missed
run2: missed
run3: missed
serovalnot runrun1: missedrun1: missedrun1: missedrun1: stopped by OpenAI's safeguard
run2: stopped by OpenAI's safeguard
run3: stopped by OpenAI's safeguard		run1: missed
run2: missed
run3: missed
datamodel-code-generatornot runnot runstopped for budget, no reportrun1: caughtrun1: stopped by OpenAI's safeguard
run2: stopped by OpenAI's safeguard
run3: stopped by OpenAI's safeguard		run1: missed
run2: missed
run3: missed
Per-run results. Counts refer to the answer key.
ToolTargetRunResultOther findingsMinutesList-price US$
Plain Codexcurlrun1stopped by OpenAI's safeguard05.00.71
Plain Codexcurlrun2stopped by OpenAI's safeguard04.80.73
Plain Codexcurlrun3stopped by OpenAI's safeguard05.71.02
Semgrepcurlrun1missed00.1not measured
Semgrepcurlrun2missed00.1not measured
Semgrepcurlrun3missed00.1not measured
Plain Claude Codedatamodel-code-generatorrun1caught014.18.44
Plain Codexdatamodel-code-generatorrun1stopped by OpenAI's safeguard01.40.21
Plain Codexdatamodel-code-generatorrun2stopped by OpenAI's safeguard02.60.28
Plain Codexdatamodel-code-generatorrun3stopped by OpenAI's safeguard03.00.32
Semgrepdatamodel-code-generatorrun1missed190.1not measured
Semgrepdatamodel-code-generatorrun2missed190.1not measured
Semgrepdatamodel-code-generatorrun3missed190.1not measured
Claude Code's security pluginfast-jwtrun1caught118.913.47
/security-reviewfast-jwtrun1missed06.81.44
Codex Securityfast-jwtrun1caught433.321.81
Plain Claude Codefast-jwtrun1caught43.50.98
Plain Codexfast-jwtrun1stopped by OpenAI's safeguard02.10.17
Plain Codexfast-jwtrun2stopped by OpenAI's safeguard02.80.19
Plain Codexfast-jwtrun3stopped by OpenAI's safeguard02.70.18
Semgrepfast-jwtrun1missed70.1not measured
Semgrepfast-jwtrun2missed70.1not measured
Semgrepfast-jwtrun3missed70.0not measured
Plain Codexpydantic-airun1missed45.30.59
Plain Codexpydantic-airun2missed26.30.78
Plain Codexpydantic-airun3missed35.30.74
Semgreppydantic-airun1missed10.2not measured
Semgreppydantic-airun2missed10.2not measured
Semgreppydantic-airun3missed10.2not measured
/security-reviewserovalrun1missed24.41.72
Codex Securityserovalrun1missed7886.151.21
Plain Claude Codeserovalrun1missed83.01.29
Plain Codexserovalrun1stopped by OpenAI's safeguard01.30.16
Plain Codexserovalrun2stopped by OpenAI's safeguard01.70.15
Plain Codexserovalrun3stopped by OpenAI's safeguard03.10.23
Semgrepserovalrun1missed10.1not measured
Semgrepserovalrun2missed10.1not measured
Semgrepserovalrun3missed10.0not measured