Incorrect Authorization Affecting @ai-sdk/harness-codex package, versions <1.0.29

@ai-sdk/harness-codex is a HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex CLI. The adapter ships a bridge process that runs inside a sandbox and talks to the host over a WebSocket on a sandbox-proxied l

Affected versions of this package are vulnerable to Incorrect Authorization through the CLI relay authorization path in the harness bridge and tool-relay-auth component. An attacker can invoke host-exposed tools such as secret lookups, deployment actions, or cloud API calls by sending relay requests from untrusted code whose process command line includes an allowed helper script path, even without a matching model-authorized tool-call event. The vulnerable relay server on Linux checked /proc to decide whether a request came from an allowed process and accepted the tool call if that process-path match succeeded. In an active harness session, malicious dependency code, build scripts, or lifecycle hooks can abuse that fallback to trigger privileged host tool execution and leak or misuse sensitive data and external services.

Notes

• Linux-only fallback: the bypass depends on the relay inspecting /proc and matching the requester’s command line against an allowed helper script path, so non-Linux deployments are not exposed to this path-based authorization check.
• The vulnerable relay is only relevant in harness sessions that expose host tools; the malicious code can be in untrusted dependencies, build scripts, or lifecycle hooks running inside the sandbox.

Workarounds

• Do not run the Codex harness on untrusted repositories or with untrusted dependencies; this prevents untrusted sandbox code from reaching the host tool relay path.
• Limit host-exposed tools to non-sensitive operations when working with untrusted code; this reduces the impact if an attacker can trigger a relay request.

• GitHub Commit
• GitHub PR
• Maintainer's Advisory