The @ai-sdk/harness-opencode tool connects HarnessAgent to OpenCode via a sandboxed bridge. Before version 1.0.28, it authorized relay requests based on a process command line containing an allowed helper script path, which allowed untrusted sandboxed code to invoke arbitrary host-exposed tools such as secret lookups, deployment operations, and cloud API calls without proper model-authorized tool-call events. Exploitation requires a Linux environment, an active harness session with host tools, and untrusted code executing in the sandbox. The fix in version 1.0.28 removes this fallback authorization and requires exact, short-lived, one-time authorization matching tool names and inputs from bridge-observed model events. Workarounds include not running the harness on untrusted repositories or dependencies and limiting host-exposed tools to non-sensitive operations when untrusted code is present.

Untrusted code executing in the sandbox can bypass intended authorization controls and invoke sensitive host-exposed tools, potentially leading to unauthorized secret lookups, deployment operations, and cloud API calls. This could compromise confidentiality and integrity of operations managed by the harness. The vulnerability requires specific conditions including Linux platform, an active harness session, and untrusted sandboxed code.

A fix is available in version 1.0.28 of @ai-sdk/harness-opencode, which removes the vulnerable authorization fallback and enforces strict one-time authorization. Until upgrading, users should avoid running the OpenCode harness on untrusted repositories or with untrusted dependencies, and limit host-exposed tools to non-sensitive operations when working with untrusted code. Patch status is not explicitly confirmed in the vendor advisory, but the fix is described in version 1.0.28 release notes. Users should upgrade to version 1.0.28 or later to remediate this vulnerability.