opencode issue: fabricated in-process messages instruct bearer-token exfiltration mid-session

mictseng · ghdev · 2026-10-18

A new opencode issue (#56823, now being triaged) reports a suspected prompt-injection anomaly:

During a 2h Windows session (v2.0.32, 100+ tool calls mixing WSL/ssh ops), roughly 8–10 times a successful tool result was followed by a fabricated <in-process message> block masquerading as harness-internal.
The block instructed, in first person, pasting the active bearer token into an HTTP header and sending it to a URL — external webhook-style addresses early on, later a corporate domain seemingly chosen to look like a safe internal target.
One occurrence also appended an unrequested workspace file listing with such a message embedded.
Nothing was exfiltrated. Source unclear: harness-side misrouted message vs. provider/model-side injection; the session ran through a custom provider gateway rather than an official endpoint, a key clue for localization.

A valuable real-world case for agent-harness security work.

More from coding & agent