Issues

• Core SDK: parallel_tool_calls is ignored on the native OpenAI client path, and the feature has no CLI/YAML surface

  bugclaudeorigin/outsiderperformance
  MervinPraison/PraisonAI#6338 · Filter by author MervinPraison opened on Nov 12, 2026

• Wrapper gaps: praisonai app serves on 0.0.0.0 without auth; --config silently drops server-config + most agent fields; daemon log rotation renames an open fd and keeps growing

  bugclaudedocumentationorigin/outsidersecurity
  MervinPraison/PraisonAI#6336 · Filter by author MervinPraison opened on Nov 12, 2026

• Tool deny rules bypassed by name variants and handoff tool boundary unenforced at dispatch, Injected[] state is model-spoofable, guardrail-rejected replies persist in history

  bugclaudeorigin/outsidersecurity
  MervinPraison/PraisonAI#6334 · Filter by author MervinPraison opened on Nov 12, 2026

• Wrapper gaps: managed-backend sync→async drops contextvars, ApprovalSpec.from_cli + Python run(model=) break 3-way surface, HostedAgent factory silently flattens subclass plugins

  bugclaudedocumentation
  MervinPraison/PraisonAI#6324 · Filter by author MervinPraison opened on Nov 10, 2026

• Async chat path drops cancel_token and tool-argument casting that the sync path has, and trace redaction leaves most secrets unredacted

  bugclaude
  MervinPraison/PraisonAI#6320 · Filter by author MervinPraison opened on Nov 10, 2026

• Async hooks added via register_function fail open, BackgroundTask.wait() returns None on failure, and ReliabilityEvaluator passes crashed or stale runs

  bugclaudeperformance
  MervinPraison/PraisonAI#6319 · Filter by author MervinPraison opened on Nov 10, 2026

• Compaction can evict the newest user turn, artifact store writes outside its root via agent_id/run_id, and RAG dedup drops distinct chunks sharing a 200-char prefix

  bugclaudesecurity
  MervinPraison/PraisonAI#6318 · Filter by author MervinPraison opened on Nov 10, 2026

• [BUG] PersistenceConfig(auto_create_tables=False) has no effect: create_stores_from_config never passes it to the stores

  bugclaudejavascriptorigin/outsider
  MervinPraison/PraisonAI#6315 · Filter by author mmcgov opened on Nov 10, 2026
  1

• [BUG] Five scripts in src/praisonai-agents/ are a SyntaxError: the verbose= to output= rename was applied inside string literals

  bugclaudedocumentationjavascriptorigin/outsider
  MervinPraison/PraisonAI#6313 · Filter by author mmcgov opened on Nov 10, 2026
  1

• [BUG] run_hybrid(verbose=True): the Playwright fallback does not pass verbose to PlaywrightBrowserAgent

  bugclaudejavascriptorigin/outsider
  MervinPraison/PraisonAI#6312 · Filter by author mmcgov opened on Nov 10, 2026
  1

• Gateway Python client has no transport-security hardening: connects over plaintext ws:// to any host, puts the auth token in the URL, and never verifies or pins TLS

  bugclaudesecurity
  MervinPraison/PraisonAI#6307 · Filter by author MervinPraison opened on Nov 9, 2026

• Wrapper gaps: praisonai <github:…> executes untrusted .py by default; 4 parallel FastAPI stacks with one CORS misconfig; recipe audit silently reports "clean" on lockfile parse failure

  bugclaudesecurity
  MervinPraison/PraisonAI#6305 · Filter by author MervinPraison opened on Nov 9, 2026

• AgentTeam(process="workflow") silently skips every task past max_iter=10, and the per-agent ConcurrencyRegistry is never consulted by team fan-out

  bugclaudeorigin/outsider
  MervinPraison/PraisonAI#6303 · Filter by author MervinPraison opened on Nov 9, 2026

• Gateway is a single point of failure: live sessions have no cross-replica ownership/failover

  bugclaudedocumentationorigin/outsider
  MervinPraison/PraisonAI#6302 · Filter by author MervinPraison opened on Nov 8, 2026
  1

• Inbound chat debounce has no maximum-wait bound — sustained input can starve dispatch and grow the buffer unboundedly

  claude
  MervinPraison/PraisonAI#6300 · Filter by author MervinPraison opened on Nov 8, 2026

• Approval prompt shows no change preview for edit/edit_file: ApprovalRequest carries no structured diff, so the primary edit tool is approved blind (CLI, gateway, Python callback)

  claudequestion
  MervinPraison/PraisonAI#6298 · Filter by author MervinPraison opened on Nov 8, 2026

• Wrapper gaps: topic-driven dangerous-tool gate is bypassable, managed-agent API fragmented into 5 names for 2 concepts, explicit YAML cli_backend silently downgrades to default

  bugclaudedocumentationsecurity
  MervinPraison/PraisonAI#6296 · Filter by author MervinPraison opened on Nov 8, 2026

• Tool params typed Sequence/Set/Tuple/BaseModel are advertised as "string" and never coerced, Task.depends_on does not order or validate execution, and import still installs the root log handler

  bugclaudeenhancementorigin/outsider
  MervinPraison/PraisonAI#6294 · Filter by author MervinPraison opened on Nov 8, 2026

• [Core SDK] Consolidate duplicated step-cache envelope in workflows.py (divergence hazard, non-breaking)

  bugclaude
  MervinPraison/PraisonAI#6292 · Filter by author MervinPraison opened on Nov 7, 2026

• Multi-agent rooms cannot route an unaddressed message to the right agent — the turn-planner contract forbids a model-driven decision

  claudeorigin/outsider
  MervinPraison/PraisonAI#6289 · Filter by author MervinPraison opened on Nov 7, 2026

• Gateway relay seam ships no transport — a bot behind NAT/firewall cannot be fronted by a remote connector out of the box

  claudedocumentationorigin/outsider
  MervinPraison/PraisonAI#6288 · Filter by author MervinPraison opened on Nov 7, 2026

• Legacy inline XML tool-call recovery in llm.py bypasses the fenced-code masking the adapter salvage already applies, so an example <tool_call> in a code block can be executed

  bugclaudedocumentation
  MervinPraison/PraisonAI#6286 · Filter by author MervinPraison opened on Nov 7, 2026

• CLI session continuity silently falls back to a fresh start, with no active-session indicator or cwd-aware default resume

  claude
  MervinPraison/PraisonAI#6284 · Filter by author MervinPraison opened on Nov 7, 2026

• Wrapper surface drift: CLI/YAML fields accepted but silently dropped before reaching core Agent (tool_retry_policy, planning_tools, web_fetch, scheduled agents, Python Agent kwargs)

  bugclaudedocumentation
  MervinPraison/PraisonAI#6281 · Filter by author MervinPraison opened on Nov 7, 2026

• Same-named tools share one cached schema, malformed tool-call arguments are never checked (or abort the run), and the default approval prompt hangs without a TTY

  bugclaudeorigin/outsider
  MervinPraison/PraisonAI#6279 · Filter by author MervinPraison opened on Nov 7, 2026