The @ai-sdk/harness-codex tool used the Codex CLI shim to authorize tool calls based on the command line of a process matching an allowed helper script path. Prior to version 1.0.29, if the command line contained this helper script path the call was accepted, allowing code running in a sandbox to invoke arbitrary host‑exposed tools without a model‑authorized tool call event. Consequently, an attacker could invoke secret lookups, deployment operations, or any other cloud API calls exposed through these tools, violating confidentiality, integrity, and availability. The weakness is a classic authorization bypass, identified as CWE‑863.

All installations of Vercel's @ai-sdk/harness-codex with a version earlier than 1.0.29 on Linux systems where the harness is used with host‑provided tools. The vulnerability specifically targets the fallback that checks for a Linux platform and attempts to read /proc to verify the helper script path.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of < 1% suggests a low likelihood of current exploitation, and the issue is not yet listed in CISA's KEV catalog. However, the attack requires an active harness session with a host‑provided tool suite and untrusted code executing within the sandbox, such as malicious dependencies or build scripts. If these conditions are met, the vulnerability can be leveraged to execute arbitrary host operations without proper authorization, potentially exposing secrets or performing unauthorized deployments.