Pydantic AI 2.60.0 adds Docker sandboxes and hardening
Updated Pydantic AI
Summary
Pydantic AI v2.60.0, published October 23, 2026, adds Docker and BoxLite sandbox capabilities plus sanitization and filesystem hardening.
- Tool
- Pydantic AI
- Category
- Frameworks
- Date
- Open source
- Yes
- License
- MIT
- Pricing
- Not stated in the sources we cited.
Pydantic AI v2.60.0 was published on GitHub on October 23, 2026 (the release is dated 2026-10-22 in its header). According to the release notes, it adds local sandbox capabilities, extends ModelSelectionContext, and tightens several security-related behaviors.
Release facts
| Fact | Detail |
|---|---|
| Product | Pydantic AI |
| Release | v2.60.0 |
| Release date | October 23, 2026 (published on GitHub) |
| License | MIT, as reported by the GitHub API for the repository |
| Where to get it | GitHub release v2.60.0 |
What changed
- New sandboxes. The release notes list a
DockerSandboxharness capability that runs the workspace in a local Docker or Podman container, andBoxLiteSandbox, a local BoxLite micro-VM workspace.SmolSandboxBackendcan now use a VM the application already has. - Model selection context.
ModelSelectionContextgainsusage_limits,deadline,run_idandconversation_id, plus the run's output retry count and budget. - Filesystem and browser safeguards.
FileSystemdenied and read-only patterns now match case-insensitively,.gitfiles are protected, and reads and Python regex searches are bounded.BrowserUsesecrets are kept on allowlisted sites and out of tool results. - Untrusted history.
sanitize_messagesstrips request-levelinstructionsfrom untrusted history and drops client-suppliedTextContent.metadatafrom user prompts. - Retry modeling.
RetryPromptPartis deprecated in favor ofToolReturnPart(outcome='retried')andRetryFeedbackPart. - Provider behavior.
BedrockConverseModelnow defaultsmaxTokensto Claude's maximum output, and embedding models raise error categories such asModelRateLimitError.'max'is added to unifiedthinkingeffort levels.
The notes place several of these items under "Compatibility Notes", so teams upgrading should read the full list.
Questions
Is anything deprecated in v2.60.0?
Yes. The release notes deprecate RetryPromptPart and OpenAIDecisionsProvider, and deprecate plain http:// URLs for the GitHub capability.
Does the release change Bedrock behavior?
According to the release notes, BedrockConverseModel now defaults maxTokens to Claude's maximum output and streams such requests behind the scenes.
What license does the project use? The GitHub API reports the repository license as MIT. The cited sources do not state pricing for any hosted service.
See the Pydantic AI hub, the Frameworks category, and the earlier Pydantic AI 2.58.0 launch for more.
Alternatives
| Tool | License | Pricing note |
|---|---|---|
Pydantic AIThis launchPydantic AI is a model-agnostic Python framework for building typed AI agents and applications. | MIT | Not stated |
AgnoAgno is an orchestration and service layer for agents, exposing them through a REST API and an MCP server. | Apache-2.0 | Not stated |
CrewAICrewAI is a framework for orchestrating role-playing, autonomous AI agents that work together. | MIT | Not stated |
LangGraphLangGraph is an open-source orchestration runtime for building stateful, resilient agents. | MIT | Not stated |
adk-pythonAn open-source, code-first Python toolkit for building, evaluating and deploying AI agents. | Apache-2.0 | Not stated |
More from Pydantic AI
Pydantic AI 2.67 moves native-tool options
Pydantic AIA long compatibility list: provider_settings for native tools, RepoContext instruction loading, durable guardrails and new Claude and Gemini models.
Category: Frameworks
Pricing: Not stated
Pydantic AI 2.64 adds model fallback controls and artifact scanning
Pydantic AIFallback timing, provider-state boundaries and a Boxd sandbox arrive with harness and evaluation changes.
Category: Frameworks
Pricing: Not stated
Pydantic AI 2.63 adds loop detection and shared spend budgets
Pydantic AINew evaluation timeouts, IPython Code Mode and PostgreSQL-backed spend storage arrive with changed defaults.
Category: Frameworks
Pricing: Not stated
Pydantic AI 2.62 adds steerable subagent tasks
Pydantic AIThe framework adds background-task controls, provider batch requests and mid-conversation thinking settings, with durable replay compatibility cautions.
Category: Frameworks
Pricing: Not stated
Pydantic AI 2.61 adds structured citations and durable extensions
Pydantic AIPydantic AI adds structured text citations, provider normalization and a public durable-engine extension surface, with compatibility changes.
Category: Frameworks
Pricing: Not stated
Pydantic AI 2.58.0 fixes MCP telemetry exposure and adds run deadlines
Pydantic AIPydantic AI ships two medium-severity security fixes, run and request timeouts, delegated-task steering, and new ChatGPT and ElevenLabs integrations.
Category: Frameworks
Pricing: Not stated
Pydantic AI 2.57 adds tool-approval review and MCP Apps routing
Pydantic AIThe October 16 release adds ApprovalReviewer, MetaProvider and MCP Apps frontend integration, with realtime compatibility changes.
Category: Frameworks
Pricing: Open source
Pydantic AI 2.55.0 adds Conversation and prompt caching
Pydantic AIPydantic AI 2.55.0, released October 9, 2026, requires Python 3.11 and adds Conversation, a unified cache setting and Postgres stores.
Category: Frameworks
Pricing: Open source
Questions
What is Pydantic AI?
The product site describes it as a model-agnostic Python framework featuring type safety, structured outputs, validation and observability.
Is Pydantic AI open source?
The GitHub repository reports an MIT license.
Which models does it support?
The product site says it supports OpenAI, Anthropic, Google and more.
Filed on Agent Radar. Claims in this note are limited to the sources above.