CVE-2026-64651: AI SDK Harness OpenCode Auth Bypass Flaw

CVE-2026-64651 Overview

CVE-2026-64651 is a broken authorization vulnerability [CWE-863] in the @ai-sdk/harness-opencode package, which bridges HarnessAgent to OpenCode through a sandboxed relay. Prior to version 1.0.28, the tool relay authorized requests from any process whose command line contained the allowed helper script path host-tool-mcp.mjs. Untrusted code executing inside the sandbox can invoke arbitrary host-exposed tools, including secret lookups, deployment operations, and cloud API calls, without a corresponding model-authorized tool-call event.

Critical Impact
Malicious dependencies, build scripts, or lifecycle hooks running inside the sandbox can bypass model authorization to invoke sensitive host tools such as secret retrieval and cloud API operations.

Affected Products

@ai-sdk/harness-opencode versions prior to 1.0.28
Vercel AI SDK harness deployments on Linux hosts
HarnessAgent sessions exposing host-provided tools to OpenCode

Discovery Timeline

2026-07-20 - CVE-2026-64651 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-64651

Vulnerability Analysis

The @ai-sdk/harness-opencode tool acts as a bridge between HarnessAgent and OpenCode, relaying tool-call requests from sandboxed code to the trusted host. The relay is expected to accept only requests authorized by model-generated tool-call events observed on the bridge. Instead, the vulnerable fallback path inspects the calling process command line and grants authorization when it references the helper script host-tool-mcp.mjs. Any process the attacker can influence inside the sandbox satisfies this check.

The attack surface is limited to Linux environments because the vulnerable code path is gated on process.platform === 'linux' and enumerates /proc to read peer command lines. Exploitation requires an active harness session with one or more host-provided tools registered and untrusted code running in the sandbox. Common delivery vectors include malicious npm dependencies, build scripts, and package lifecycle hooks executed during install or test phases.

Root Cause

The root cause is authorization by process-path pattern matching. Command-line arguments are attacker-controllable within the sandbox, so string matching on host-tool-mcp.mjs in /proc/<pid>/cmdline is not a trustworthy identity check. The relay conflated helper-process identity with model authorization, treating the presence of the helper path as proof that the request originated from a legitimate tool-call event.

Attack Vector

Attacker-controlled code inside the sandbox spawns or names a process such that its command line contains host-tool-mcp.mjs, then issues a request to the relay socket. The relay walks /proc, matches the command line, and accepts the request as authorized. The attacker then invokes any host-exposed tool with arbitrary inputs, without waiting for or corresponding to a model-generated tool-call event. See the GitHub Security Advisory GHSA-g48p-5rr5-8rgq for additional detail.

Detection Methods for CVE-2026-64651

Indicators of Compromise

Relay tool invocations that lack a preceding model-authorized tool-call event on the bridge
Unexpected sandbox processes whose /proc/<pid>/cmdline references host-tool-mcp.mjs but were not spawned by the harness
Host tool activity such as secret lookups, cloud API calls, or deployment operations initiated during dependency install, build, or lifecycle hook execution

Detection Strategies

Correlate relay accept events with bridge-observed model tool-call events and alert on any relay call without a matching authorization
Audit outbound calls from harness sessions for use of high-sensitivity tools (secret managers, cloud control planes) that were not requested by the model
Inspect npm dependency trees and lifecycle scripts for postinstall, prepare, or test hooks that spawn helper processes or open sockets

Monitoring Recommendations

Log every host-tool invocation with tool name, input hash, requesting PID, and the model event ID that authorized it
Enable process creation auditing on Linux harness hosts and alert on new processes whose argv contains host-tool-mcp.mjs
Ship harness relay and dependency install telemetry into a centralized data lake for retrospective hunting across sessions

How to Mitigate CVE-2026-64651

Immediate Actions Required

Upgrade @ai-sdk/harness-opencode to version 1.0.28 or later across all harness hosts and CI runners
Rotate any secrets, tokens, and cloud credentials that were reachable through host-exposed tools during the vulnerable window
Review recent harness session logs for tool invocations lacking a corresponding model authorization event

Patch Information

The fix in version 1.0.28 removes the process-path authorization fallback entirely. Relay requests are now accepted only after an exact, short-lived, one-time authorization that matches the tool name and input from a bridge-observed model event. Patch details are available in the Vercel AI GitHub Pull Request #17105.

Workarounds

Do not run the OpenCode harness on untrusted repositories or with untrusted dependencies
Limit host-exposed tools to non-sensitive operations when working with untrusted code
Run the harness on non-Linux platforms where the vulnerable fallback path is not reachable, if operationally feasible

bash

# Upgrade to the patched version
npm install @ai-sdk/harness-opencode@1.0.28

# Verify installed version
npm ls @ai-sdk/harness-opencode