Executive brief
OpenHarness is an AI agent framework that allows users to manage project context through slash commands. An attacker with access to a remote channel can inject malicious Markdown into project context files (/issue and /pr_comments commands), which are later loaded into the AI agent's system prompts. This persistent poisoning causes the agent to act on attacker-supplied instructions on all future interactions, compromising the integrity of agent behavior and potentially leading to unintended actions.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the OpenHarness slash command dispatch layer. The /issue and /pr_comments commands inherited the default remote_invocable=True behavior without explicit override, allowing remote gateway messages to reach the command handlers. These handlers write user-supplied Markdown directly into .openharness/issue.md and .openharness/pr_comments.md files. Since these files are later injected into runtime system prompts as project context, an admitted remote channel sender can persistently influence local agent behavior through prompt injection. Attack vector is network-based and requires low privilege (authenticated remote channel access). The fix, merged in May 2026, marks both commands as local-only (remote_invocable=False) by default while preserving optional remote-admin opt-in for trusted deployments. No patched version is yet available for versions ≤ 0.1.9.
Affected products
- HKUDS OpenHarness <= 0.1.9
Timeline
- 2026-06-23: disclosed
- 2026-06-23: advisory: GitHub Advisory published
- 2026-05-24: patched: Fix merged in PR #272 (27bb93b); no patched release yet available