Your coding agent runs a shell on your machine. I audited mine.

Short summary

The author audited their own local agent daemon (agentproto) after a CVE in opencode exposed how localhost command-execution endpoints can be exploited by any website via browser fetch(). The fix centers on two boundaries: OS-level process rights (shell:false, binary allowlists) and network posture (Origin-header gating, Host-header validation for DNS rebinding). The methodology transfers to any agent tool that runs bash locally — check port binding, CORS, auth bypasses, and command filtering approach.

• •Local agent daemons that run bash are vulnerable to browser drive-by RCE via CORS and loopback auth bypasses
• •Fix: Origin-header gating (browsers send Origin, native clients don't) plus Host-header validation for DNS rebinding
• •Command-string filtering doesn't work; use shell:false with verbatim argv and binary allowlists instead

Generated with AI, which can make mistakes.