The @ai-sdk/harness-opencode tool, a HarnessV1 adapter backed by @openai/codex-sdk, prior to version 1.0.29, authorizes relay requests from any process whose command line contains an allowed helper script path. This fallback authorization mechanism allows untrusted code executing in a Linux sandbox to invoke arbitrary host-exposed tools such as secret lookups, deployment operations, and cloud API calls without a corresponding model-authorized tool-call event. The vulnerability requires a Linux environment (due to platform checks and /proc reading), an active harness session with host-provided tools, and untrusted code execution in the sandbox (e.g., malicious dependencies or build scripts). The fix in version 1.0.29 removes this fallback authorization and requires exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event. Workarounds include not running the Codex harness on untrusted repositories or dependencies and limiting host-exposed tools to non-sensitive operations when working with untrusted code.

An attacker with untrusted code execution in the sandbox on a Linux environment can exploit this vulnerability to invoke arbitrary host-exposed tools without proper authorization. This can lead to unauthorized secret lookups, deployment operations, and cloud API calls, potentially compromising sensitive information and operations. The vulnerability does not require user interaction or privileges beyond untrusted code execution in the sandbox.

A fix is available in version 1.0.29 of @ai-sdk/harness-codex, which removes the insecure fallback authorization mechanism and enforces strict, short-lived authorization tied to model events. Until upgrading, it is recommended not to run the Codex harness on untrusted repositories or with untrusted dependencies. Additionally, limit host-exposed tools to non-sensitive operations when working with untrusted code to reduce risk.