AIKIDO-2026-833155

TL;DR

The Codex harness in @ai-sdk/harness-codex relays tool calls from sandboxed code to host-exposed tools, and a fallback authorization path accepts any request whose calling process command line contains the allowed Codex CLI shim path. On Linux the relay reads /proc and grants authorization on that path match instead of requiring a model-authorized tool-call event. Untrusted code running in the sandbox, such as a malicious dependency or build script, can therefore invoke arbitrary host tools including secret lookups, deployment operations, and cloud API calls. The fix removes the process-path fallback and only accepts relay requests that match a short-lived, one-time authorization derived from a bridge-observed model event.