---
id: "GHSA-g3x3-7q3h-gmhj"
page: "https://infrastack.ai/live/GHSA-g3x3-7q3h-gmhj"
kind: "vulnerability"
aliases: ["GHSA-g3x3-7q3h-gmhj"]
title: "AI SDK ACP Harness Host Tool Relay Authorization Bypass"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "ai-sdk", "fixed": ["1.0.77"], "affected": ">= 1.0.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["agents", "ai-sdk", "ai-tooling", "harness-acp", "sandbox"]
not_affected_if: ["approval-required-tools", "no-host-tools", "not-using-acp-harness"]
published_at: "2026-10-01T19:22:11+00:00"
first_seen_at: "2026-11-09T22:53:18+00:00"
updated_at: "2026-11-09T23:01:20+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/vercel/ai/security/advisories/GHSA-g3x3-7q3h-gmhj", "first_seen_at": "2026-11-09T22:53:18+00:00"}]
exploit_sources: []
---

# AI SDK ACP Harness Host Tool Relay Authorization Bypass

Link for people: https://infrastack.ai/live/GHSA-g3x3-7q3h-gmhj (this .md is for agents)

The @ai-sdk/harness-acp host-tool relay did not check that relay requests matched tool calls the model actually generated. Code running in a sandbox that obtained the relay credential could invoke registered host tools during an active prompt turn.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:ai-sdk affected >= 1.0.0 fixed 1.0.77

## How to check

- Check the installed version of `ai-sdk` or `@ai-sdk/harness-acp` with `npm ls @ai-sdk/harness-acp`
- Look for applications that register host tools and run sandboxed untrusted code alongside the ACP harness
- Confirm whether tools that act on the host lack explicit user approval

## Fix

- `@ai-sdk/harness-acp` `1.0.77` or later

## Timeline

- 2026-11-09T22:53:18+00:00 ghsa-repo https://github.com/vercel/ai/security/advisories/GHSA-g3x3-7q3h-gmhj

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/vercel/ai/security/advisories/GHSA-g3x3-7q3h-gmhj

## From the sources

### Impact

The `@ai-sdk/harness-acp` host-tool relay did not verify that relay requests matched model-generated tool calls. Untrusted sandbox code that obtained the relay credential could invoke registered host tools during an active prompt turn.

Impact depends on the tools exposed by the application. Tools requiring explicit user approval remain protected.

### Patches

Upgrade to `@ai-sdk/harness-acp` 1.0.77 or later.

### References

- https://github.com/vercel/ai/pull/21826

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_