Incorrect Authorization Affecting @ai-sdk/harness-opencode package, versions <1.0.29

@ai-sdk/harness-opencode is a The OpenCode harness connects HarnessAgent to OpenCode through a sandboxed bridge.

Affected versions of this package are vulnerable to Incorrect Authorization through the tool relay in tool-relay-auth.ts and tool-relay.ts. An attacker can invoke host-exposed tools, including sensitive lookups and cloud operations, by sending a relay request from sandboxed code whose process command line contains the allowed helper script path. The vulnerable relay accepted requests on Linux based on /proc process inspection instead of a matching model-authorized tool call, so untrusted code running inside the harness could reach the host tool server without a corresponding authorization event. This breaks the harness’s tool-use controls and can expose secrets or trigger unintended host-side actions for users running the harness with untrusted repositories or dependencies.

Notes

• Linux-only fallback authorization depended on /proc process and socket inspection, so the bypass was specific to hosts where the harness could read /proc and correlate the relay connection back to a process command line.
• The vulnerable path was gated on the relay session’s configured helper script allowlist (host-tool-mcp.mjs / CLI shim path), which meant any sandboxed code able to invoke that helper path inside the same harness session could satisfy the check.

Workarounds

• Do not run the OpenCode harness on untrusted repositories or with untrusted dependencies; this prevents sandboxed code from reaching the host relay through malicious build scripts, lifecycle hooks, or dependencies.
• Limit host-exposed tools to non-sensitive operations when using untrusted code; this reduces what an attacker can do if they trigger tool relay access.

• GitHub Commit
• GitHub PR
• Maintainer's Advisory