AIKIDO-2026-796970

TL;DR

The OpenCode harness in @ai-sdk/harness-opencode relays tool calls from sandboxed code to host-exposed tools, and a fallback authorization path accepts any request whose calling process command line contains an allowed helper script path. On Linux the relay reads /proc and grants authorization on that path match instead of requiring a model-authorized tool-call event. Untrusted code running in the sandbox, such as a malicious dependency or lifecycle hook, can therefore invoke arbitrary host tools including secret lookups, deployment operations, and cloud API calls. The fix removes the process-path fallback and only accepts relay requests that match a short-lived, one-time authorization derived from a bridge-observed model event.