CVE-2026-107291: Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

Pydantic AI’s OpenTelemetry instrumentation supports InstrumentationSettings(include_content=False) to exclude message content — user prompts, model completions, tool call arguments and responses, and any other message content — from exported telemetry, so that agents can be monitored without sending sensitive content to the observability backend.

The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:

• Exceptions. Recorded as OpenTelemetry exception events, with their message and stack trace, on tool, agent run, model request, embedding and image generation spans, and on realtime session spans. The message of the exception carrying a tool’s ModelRetry or ToolFailed feedback is the text sent back to the model, which can quote tool arguments and results. When a tool ran out of retries, the error that ended the run was chained from the last retry, so its stack trace repeated that text on the run span. Exceptions raised by tool code were recorded with their full message, as were failures of a model request, embedding or image generation, whose messages carry the provider’s error response body.
• The error status description. The OpenTelemetry SDK describes a span’s ERROR status with the exception’s type and message, so the message reached the backend a second time even where the event itself was redacted.
• Instructions and the prompted-output template. The model_request_parameters attribute serialized the request’s instruction parts in full, exporting the agent’s instructions — both static and those built from dependencies at request time — along with the template used to prompt for structured output.