Executive brief
A security flaw in the Vercel AI SDK Codex harness allows untrusted code, such as a malicious dependency or build script, to bypass security checks and access sensitive host tools. This could lead to unauthorized data access, secret theft, or the execution of cloud deployment operations without the user's permission. The issue specifically affects Linux environments where the tool is used to bridge AI models with local system commands.
Technical details
An authorization bypass vulnerability exists in the @ai-sdk/harness-codex and @ai-sdk/harness-opencode adapters due to an insecure process-path validation fallback. In Linux environments, the tool relay incorrectly authorized requests from any process whose command line contained the Codex CLI shim path by reading /proc. This allows malicious code (e.g., via a lifecycle hook or dependency) to trigger host-exposed tools like secret lookups or cloud API calls without a legitimate model-authorized tool-call event. The vulnerability was fixed in version 1.0.29 by removing the process-path fallback and implementing a short-lived, one-time authorization token matched against bridge-observed model events.
Affected products
- Vercel @ai-sdk/harness-codex < 1.0.29
- Vercel @ai-sdk/harness-opencode < 1.0.29
Timeline
- 2026-07-10: patched: Fix merged in PR 17105
- 2026-07-20: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE-2026-64650 published to NVD