Tool makes HTTP calls with no timeout
LowAV-RUNTIME-015Runtime safetyCore packNew in 2.0
What it finds
A tool calls requests.* without a timeout.
Why it matters
Python requests waits forever by default. One slow or malicious server can hang the agent, tie up workers, and run up model costs while it waits.
What an attacker could do: The agent can be stalled indefinitely by any slow endpoint.
How to fix it
Set a timeout on every outbound call.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- HTTP_CALL_NO_TIMEOUT
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Any text-based agent source or configuration (JS/TS/Python/JSON/YAML)
- OWASP LLM Top 10
- LLM04 - Model Denial of Service
- NIST AI RMF
- MG-2.2
- SOC 2
- A1.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Command injection riskAV-RUNTIME-004 · Critical
- Unsafe dynamic code executionAV-RUNTIME-005 · Critical
- Privileged or host-mounted container configurationAV-RUNTIME-007 · Critical
- SQL query built from unescaped inputAV-RUNTIME-009 · Critical
- Unsafe deserialization of untrusted dataAV-RUNTIME-010 · Critical
- Prompt injection surface detectedAV-RUNTIME-002 · High