AG-UI's October 21 release closes an ADK shared-state authorization flaw and hardens recovery
AG-UI's October 21 release ships ag_ui_adk 0.11.0 plus Claude adapter updates. Its central change blocks client state from directly modifying app-wide or user-wide ADK state while tightening approval and tool-batch recovery.
Why it matters
Agent UI state can shape cross-session permissions and behavior, not just presentation. If a client can write shared scopes, state synchronization becomes an access-control boundary.
A closer look
The ADK HTTP endpoint now drops client-supplied app: and user: keys. Trusted shared state must come through the server-side extract_state_from_request hook with explicit opt-in. The release also fixes first-run history import, timestamp-tie ordering, tool-result naming when the assistant message is absent, and migrates to A2UI agent SDK 0.9 and core 0.4. Claude adapters persist deferred batches before interruption, retain unresolved child-tool identity and historical errors/results, while managed agents preserve child results across reloads.
Who this is for
Backend and security teams using AG-UI ADK, Claude SDK, approval recovery or shared state
Original sources
Revisions & corrections (1)
— Official release documents a security-relevant scoped-state fix plus recovery changes; date and package versions verified.