Exploitation observed; activity peaked at 3 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the tool relay authorizes requests from any process whose command line contains an allowed helper script path (the Codex CLI shim). This allows untrusted code executing in the sandbox to invoke arbitrary host-exposed tools, including secret lookups, deployment operations, and cloud API calls without a corresponding model-authorized tool-call event. Exploitation requires a Linux environment (the vulnerable fallback checks `process.platform === 'linux'` and reads `/proc`); an active harness session with one or more host-provided tools; and untrusted code executing in the sandbox (e.g. a malicious dependency, build script, or lifecycle hook) The fix in version 1.0.29 removes the process-path authorization fallback entirely. Relay requests are now only accepted after exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event. Some workarounds are available. Do not run the Codex harness on untrusted repositories or with untrusted dependencies, and/or limit host-exposed tools to non-sensitive operations when working with untrusted code.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
The Hacker News, August 6. CoreBreak. CVE-2026-18830, CVE-2026-18236, CVE-2026-64650, CVE-2026-64651. Fixes shipped. The class did not. https://thehackernews.com/2026/08/aws-google-and-vercel-patch-agent-flaws.html
⚠️ HIGH — CVE-2026-64650 The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command… CVSS 6.3 ⚡ Exploit in the wild Full analysis → https://sec.kaitan.id/cves/CVE-2026-64650 #OpenAI #CyberSecurity #InfoSec
Post summary
The CVE-2026-64650 vulnerability, affecting the @ai-sdk/harness-opencode adapter, has a CVSS score of 6.3 and is reportedly being exploited in the wild, though no patch or exploit code is provided.
🚨*CVE* CVE-2026-64650 The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the t… https://www.cve.org/CVERecord?id=CVE-2026-64650 ----- Traducción: CVE-2026-64650 La … http://infoflow.cloud`
Post summary
The tweet cites CVE-2026-64650 and links to its CVE record but provides no further technical or exploitation details.
CVE-2026-64650 The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the t… https://www.cve.org/CVERecord?id=CVE-2026-64650
Post summary
The text references CVE-2026-64650 and notes that the @ai-sdk/harness-opencode tool, prior to version 1.0.29, has a link to a vulnerability, but provides no further technical details, PoC, exploit, or patch guidance.