{"id":"GHSA-g3x3-7q3h-gmhj","kind":"vulnerability","aliases":["GHSA-g3x3-7q3h-gmhj"],"related":[],"title":"AI SDK ACP Harness Host Tool Relay Authorization Bypass","description":"### Impact\r\n\r\nThe `@ai-sdk/harness-acp` host-tool relay did not verify that relay requests matched model-generated tool calls. Untrusted sandbox code that obtained the relay credential could invoke registered host tools during an active prompt turn.\r\n\r\nImpact depends on the tools exposed by the application. Tools requiring explicit user approval remain protected.\r\n\r\n### Patches\r\n\r\nUpgrade to `@ai-sdk/harness-acp` 1.0.77 or later.\r\n\r\n### References\r\n\r\n- https://github.com/vercel/ai/pull/21826","summary":"The @ai-sdk/harness-acp host-tool relay did not check that relay requests matched tool calls the model actually generated. Code running in a sandbox that obtained the relay credential could invoke registered host tools during an active prompt turn.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ai-sdk","fixed":["1.0.77"],"affected":">= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["agents","ai-sdk","ai-tooling","harness-acp","sandbox"],"not_affected_if":["approval-required-tools","no-host-tools","not-using-acp-harness"],"how_to_check":"- Check the installed version of `ai-sdk` or `@ai-sdk/harness-acp` with `npm ls @ai-sdk/harness-acp`\n- Look for applications that register host tools and run sandboxed untrusted code alongside the ACP harness\n- Confirm whether tools that act on the host lack explicit user approval","fix":"- `@ai-sdk/harness-acp` `1.0.77` or later","status":"open","published_at":"2026-10-01T19:22:11+00:00","first_seen_at":"2026-11-09T22:53:18+00:00","triaged_at":"2026-11-09T23:01:20+00:00","updated_at":"2026-11-09T23:01:20+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-09T23:01:20Z","model":"claude-haiku-5-5","output":{"fix":"- `@ai-sdk/harness-acp` `1.0.77` or later","reach":"local","title":"AI SDK ACP harness: sandbox code can call host tools without approval","impact":"medium","summary":"The @ai-sdk/harness-acp host-tool relay did not check that relay requests matched tool calls the model actually generated. Code running in a sandbox that obtained the relay credential could invoke registered host tools during an active prompt turn.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["ai-sdk","harness-acp","agents","sandbox"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"sandboxed code invokes host tools without approval during a prompt turn","analyst_note":"","how_to_check":"- Check the installed version of `ai-sdk` or `@ai-sdk/harness-acp` with `npm ls @ai-sdk/harness-acp`\n- Look for applications that register host tools and run sandboxed untrusted code alongside the ACP harness\n- Confirm whether tools that act on the host lack explicit user approval","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-host-tools","approval-required-tools","not-using-acp-harness"],"who_is_affected":"Applications that use the @ai-sdk/harness-acp host-tool relay and expose tools to a model while running untrusted code in a sandbox. Impact depends on which tools the application registers; tools requiring explicit user approval remain protected. Applications not using the harness or without registered host tools can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00077,"input_tokens":4691,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'/harness-acp':38B,81C,138C '/vercel/ai/pull/21826':145C '1.0.77':139C '7q3h':13A,18A 'acp':3A,32B 'activ':73B,113C 'actual':54B 'agent':23B 'ai':1A,21A,25B,28B,36B,79C,136C 'ai-sdk':20A,24B,35B,78C,135C 'ai-tool':27B 'applic':124C 'approv':129C 'author':8A 'bypass':9A 'call':51B,97C 'check':45B 'code':56B,100C 'could':66B,106C 'credenti':65B,105C 'depend':117C 'explicit':127C 'expos':121C 'g3x3':12A,17A 'generat':55B,95C 'ghsa':11A,16A 'ghsa-g3x3-7q3h-gmhj':10A,15A 'github.com':144C 'github.com/vercel/ai/pull/21826':143C 'gmhj':14A,19A 'har':4A,31B 'harness-acp':30B 'host':5A,40B,69B,83C,109C 'host-tool':39B,82C 'impact':76C,116C 'invok':67B,107C 'later':141C 'match':49B,92C 'model':53B,94C 'model-gener':93C 'obtain':62B,102C 'patch':132C 'prompt':74B,114C 'protect':131C 'refer':142C 'regist':68B,108C 'relay':7A,42B,47B,64B,85C,90C,104C 'remain':130C 'request':48B,91C 'requir':126C 'run':57B 'sandbox':33B,60B,99C 'sdk':2A,22A,26B,37B,80C,137C 'tool':6A,29B,41B,50B,70B,84C,96C,110C,120C,125C 'turn':75B,115C 'untrust':98C 'upgrad':133C 'user':128C 'verifi':88C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the @ai-sdk/harness-acp host-tool relay and expose tools to a model while running untrusted code in a sandbox. Impact depends on which tools the application registers; tools requiring explicit user approval remain protected. Applications not using the harness or without registered host tools can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["aisdk"],"ptokens":["ai","sdk"],"labels":["agents","aisdk","aitooling","harnessacp","medium","npm","sandbox"],"campaign_type":null,"search_a":"'7q3h':13A,18A 'acp':3A 'ai':1A,21A 'ai-sdk':20A 'author':8A 'bypass':9A 'g3x3':12A,17A 'ghsa':11A,16A 'ghsa-g3x3-7q3h-gmhj':10A,15A 'gmhj':14A,19A 'har':4A 'host':5A 'relay':7A 'sdk':2A,22A 'tool':6A","search_b":"'/harness-acp':38B 'acp':32B 'activ':73B 'actual':54B 'agent':23B 'ai':25B,28B,36B 'ai-sdk':24B,35B 'ai-tool':27B 'call':51B 'check':45B 'code':56B 'could':66B 'credenti':65B 'generat':55B 'har':31B 'harness-acp':30B 'host':40B,69B 'host-tool':39B 'invok':67B 'match':49B 'model':53B 'obtain':62B 'prompt':74B 'regist':68B 'relay':42B,47B,64B 'request':48B 'run':57B 'sandbox':33B,60B 'sdk':26B,37B 'tool':29B,41B,50B,70B 'turn':75B","search_c":"'/harness-acp':81C,138C '/vercel/ai/pull/21826':145C '1.0.77':139C 'activ':113C 'ai':79C,136C 'ai-sdk':78C,135C 'applic':124C 'approv':129C 'call':97C 'code':100C 'could':106C 'credenti':105C 'depend':117C 'explicit':127C 'expos':121C 'generat':95C 'github.com':144C 'github.com/vercel/ai/pull/21826':143C 'host':83C,109C 'host-tool':82C 'impact':76C,116C 'invok':107C 'later':141C 'match':92C 'model':94C 'model-gener':93C 'obtain':102C 'patch':132C 'prompt':114C 'protect':131C 'refer':142C 'regist':108C 'relay':85C,90C,104C 'remain':130C 'request':91C 'requir':126C 'sandbox':99C 'sdk':80C,137C 'tool':84C,96C,110C,120C,125C 'turn':115C 'untrust':98C 'upgrad':133C 'user':128C 'verifi':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-01T19:22:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-g3x3-7q3h-gmhj","url":"https://github.com/vercel/ai/security/advisories/GHSA-g3x3-7q3h-gmhj","severity":"medium","published_at":"2026-10-01T19:22:11+00:00","modified_at":"2026-10-01T19:40:35+00:00","first_seen_at":"2026-11-09T22:53:18+00:00","fetched_at":"2026-11-09T22:53:18+00:00","note":null}],"documents":[{"id":110472,"url":"https://github.com/vercel/ai/security/advisories/GHSA-g3x3-7q3h-gmhj","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}