---
id: "GHSA-4mqq-99j3-3hmv"
page: "https://infrastack.ai/live/GHSA-4mqq-99j3-3hmv"
kind: "vulnerability"
aliases: ["GHSA-4mqq-99j3-3hmv"]
title: "AI SDK Harness session resume can expose host credentials to sandboxed code"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "@ai-sdk/harness-opencode", "fixed": ["1.0.135"], "affected": "< 1.0.135", "ecosystem": "npm"}, {"name": "@ai-sdk/harness-claude-code", "fixed": ["1.0.137"], "affected": "< 1.0.137", "ecosystem": "npm"}, {"name": "@ai-sdk/harness-codex", "fixed": ["1.0.135"], "affected": "< 1.0.135", "ecosystem": "npm"}, {"name": "@ai-sdk/harness-deepagents", "fixed": ["1.0.133"], "affected": "< 1.0.133", "ecosystem": "npm"}, {"name": "@ai-sdk/harness", "fixed": ["1.0.133"], "affected": "< 1.0.133", "ecosystem": "npm"}, {"name": "@ai-sdk/harness-acp", "fixed": ["1.0.71"], "affected": "< 1.0.71", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["agents", "ai-sdk", "ai-tooling", "cwe-200", "npm", "sandbox"]
not_affected_if: ["fresh-sessions-only", "no-session-resume", "same-credential-names"]
published_at: "2026-09-28T17:44:55+00:00"
first_seen_at: "2026-11-09T22:53:18+00:00"
updated_at: "2026-11-09T23:01:23+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/vercel/ai/security/advisories/GHSA-4mqq-99j3-3hmv", "first_seen_at": "2026-11-09T22:53:18+00:00"}]
exploit_sources: []
---

# AI SDK Harness session resume can expose host credentials to sandboxed code

Link for people: https://infrastack.ai/live/GHSA-4mqq-99j3-3hmv (this .md is for agents)

When an AI SDK Harness session is resumed with a credential environment variable that was not in the saved session, that credential is passed into the sandbox in raw form instead of as a placeholder. Code or agent activity inside the sandbox can then read and exfiltrate the credential, such as a model-provider API key, source-control token or OAuth token.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@ai-sdk/harness-opencode affected < 1.0.135 fixed 1.0.135
- npm:@ai-sdk/harness-claude-code affected < 1.0.137 fixed 1.0.137
- npm:@ai-sdk/harness-codex affected < 1.0.135 fixed 1.0.135
- npm:@ai-sdk/harness-deepagents affected < 1.0.133 fixed 1.0.133
- npm:@ai-sdk/harness affected < 1.0.133 fixed 1.0.133
- npm:@ai-sdk/harness-acp affected < 1.0.71 fixed 1.0.71

## How to check

- Check the installed version of each `@ai-sdk/harness*` package in your lockfile against the fixed versions listed in the sources.
- Look for code that resumes sessions from saved lifecycle state while switching providers or authentication modes between creation and resume.

## Fix

- `@ai-sdk/harness-opencode` to `1.0.135` or later
- `@ai-sdk/harness-claude-code` to `1.0.137` or later
- `@ai-sdk/harness-codex` to `1.0.135` or later
- `@ai-sdk/harness-deepagents` and `@ai-sdk/harness` to `1.0.133` or later
- `@ai-sdk/harness-acp` to `1.0.71` or later

## Timeline

- 2026-11-09T22:53:18+00:00 ghsa-repo https://github.com/vercel/ai/security/advisories/GHSA-4mqq-99j3-3hmv

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/vercel/ai/security/advisories/GHSA-4mqq-99j3-3hmv

## From the sources

### Summary
A vulnerability in AI SDK Harness credential brokering can expose host credentials to sandboxed code when an existing session is resumed with a newly introduced credential environment variable.

Credential brokering normally supplies non-secret placeholders to the sandbox and substitutes real credentials outside the sandbox boundary for approved outbound requests. Affected adapters reuse the credential-placeholder map saved with the previous session without ensuring that it covers the current authentication environment. As a result, newly introduced credentials can be passed into the sandbox without being replaced by placeholders.

### Impact

An attacker who can execute code or influence agent activity inside an affected resumed sandbox may read and exfiltrate exposed credentials without escaping the sandbox.

Depending on the adapter and authentication configuration, exposed credentials may include model-provider API keys, source-control tokens, or OAuth tokens. Subsequent access depends on the permissions and scopes granted to those credentials and may include access to private data, unauthorized changes, or paid API usage.

Exploitation requires all of the following:

- An affected Harness adapter uses credential brokering with a network sandbox supporting request transformations.
- The application resumes a session using previously saved lifecycle state.
- The resumed session introduces a credential variable absent from the saved placeholder map.
- An attacker can cause code or agent activity inside the resumed sandbox to access the exposed credential.

For example, changing providers or authentication modes between session creation and resume can introduce a new credential variable.

Fresh sessions and credential rotations that retain the same credential variable names were not affected in the tested scenarios.

### Patches
A fix is proposed in https://github.com/vercel/ai/pull/21599.

The fix reconciles the sandbox credential environment with the current authentication environment on every start and resume. It preserves placeholders for matching credential names, generates placeholders for newly introduced credentials, and removes entries for credentials no longer present.

### Workarounds
Until patched versions are available, create a fresh session and sandbox whenever the credential variable names change. Do not reuse saved lifecycle state across those transitions.

If an affected session may have exposed credentials to untrusted sandbox activity, revoke or rotate those credentials and review their usage.

### Credits
Reported by 0x4ym3n through HackerOne.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_