A flaw in Vercel AI SDK's Codex and OpenCode harnesses let sandboxed code invoke host tools without the model ever generating the call.
Vercel has patched two AI SDK packages after researchers showed that code already running inside a Vercel Sandbox could forge an AI model’s tool call and reach host-level operations, including secret lookups and deployment actions, without the model ever being asked. The fix shipped in @ai-sdk/harness-codex
1.0.29 and `@ai-sdk/harness-opencode`
1.0.28, closing CVE-2026-64650 and CVE-2026-64651 ([The Hacker News, Aug 6, 2026](https://thehackernews.com/2026/08/aws-google-and-vercel-patch-agent-flaws.html)).
What changed #
Vercel AI SDK’s harness adapters let a developer drive an established coding agent, Codex CLI or OpenCode, inside a Vercel Sandbox through one interface, with a relay bridging sandboxed code to host-exposed tools such as secret lookups, deployment operations and cloud API calls. That relay authorized a request whenever the calling process’s command line contained the path of an approved helper script, the Codex CLI shim. Malicious code already running in the sandbox, a bad dependency, a build script, a lifecycle hook, could satisfy that same check and call host tools directly, with no model turn required first. The system prompt, content filters and model-level guardrails never got a chance to intervene, because the request never passed through the model.
Exploitation needed three things: Linux, an active harness session with at least one host-provided tool, and untrusted code already executing inside the sandbox. Vercel’s fix removes the process-path fallback entirely. Relay requests are now accepted only against a short-lived, one-time authorization tied to the tool name and input from a model event the bridge actually observed (CVE-2026-64650, ThreatInt).
Vercel wasn’t alone. Researchers Hedi Ingber and Aviyam Ivgi, co-founders of security startup Stealth, presented the pattern as “CoreBreak” at Black Hat USA 2026, describing the same execution-layer gap in Amazon Bedrock AgentCore’s InvokeHarness
API and Google’s Agent Development Kit for Python: in each, the harness dispatched something shaped like a model-generated tool call without checking a real model turn produced it. The specifics differed: AWS’s path required an authenticated remote request, Google’s needed attacker-controlled session events, and Vercel’s needed code already inside the sandbox, a narrower bar but not a hard one for anyone who can slip a malicious build step into a project. AWS fixed its managed service and Google shipped ADK 2.5.0. One outlet reported AWS’s separate, open-source Strands Agents Python SDK remained unpatched at disclosure (Tech Times, Aug 6, 2026).
Why this matters #
Sandboxing an AI coding agent is supposed to mean the untrusted part, the code it writes and runs, stays contained while only the trusted part, the model’s own decisions, gets to touch the host. CoreBreak breaks that at the seam: the boundary the harness enforced wasn’t “did the model decide this,” it was “does this process look like the one that’s allowed to ask.” Command-line pattern matching is a weak proxy for identity, the kind of shortcut that ships easily because it works in every normal case and only fails once something hostile is already inside the sandbox built to contain it.
The CVSS v4.0 score, 6.3 for both Vercel CVEs, reads as moderate, since the attack needs untrusted code running in the sandbox first, not a cold start for a remote attacker. But that precondition is exactly what a coding agent is built to encounter: pulling a dependency or running a build script is the job, not an edge case. Teams driving Codex or OpenCode through Vercel AI SDK’s harness adapters should confirm they’re on harness-codex
1.0.29 or harness-opencode
1.0.28 or later before trusting the sandbox with anything that touches secrets or deployments.
Key Takeaways #
- Vercel patched
`@ai-sdk/harness-codex`
(1.0.29) and`@ai-sdk/harness-opencode`
(1.0.28) against CVE-2026-64650 and CVE-2026-64651, disclosed Aug 6, 2026. - The bug let code already running in a Vercel Sandbox forge tool-call authorization via command-line path matching, reaching host tools without any real model-generated call.
- The fix replaces that check with one-time authorization bound to an actual model event the bridge observed.
- Researchers presented the same execution-layer gap, dubbed “CoreBreak,” in AWS Bedrock AgentCore and Google ADK at Black Hat USA 2026; AWS and Google shipped their own fixes, though one report says AWS’s separate Strands Agents SDK stayed unpatched.