HKUDS OpenHarness prior to PR #147 contains an insecure default configuration vulnerability where remote channels inherit allow_from = ["*"] setting. This permits arbitrary remote senders to pass admission checks and bypass access controls. Attackers who can reach the configured channel can access host-backed agent runtimes. The vulnerability potentially leads to unauthorized file disclosure and read access through default-enabled read-only tools. The issue was remediated in version 0.1.7 and addressed through GitHub pull request #147.