AIKIDO-2026-601428

@ai-sdk/harness-claude-code is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized ActorGHSA-4mqq-99j3-3hmv Published 2 days ago

High Risk

This Affects:

@ai-sdk/harness-claude-code

1.0.0 - 1.0.136

Fixed in 1.0.137

Are you affected? Scan for Free

TL;DR

AI SDK Harness adapters pass credentials into a sandbox by substituting placeholders for the real values outside the sandbox boundary. When a session is resumed, the adapter reuses the credential placeholder map saved with the previous session instead of rebuilding it from the current authentication environment, so a credential variable added after the session was created enters the sandbox as its real value. Code or agent activity inside the resumed sandbox can then read and exfiltrate that credential without escaping the sandbox. The fix rebuilds the sandbox credential environment from the current authentication state on every resume.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you resume a saved session after a credential variable was added to the authentication environment, for example by switching providers or authentication modes.