{"record":{"id":"98e77d25072a77ee","repo":"langchain-ai/deepagents","slug":"config-provider-exposure-mode-open-allows-arbi","errorCode":null,"errorMessage":"{config.provider} exposure mode 'open' allows arbitrary senders to trigger the agent with operator credentials and local host access; set {config.open_ack}={config.open_ack_value} to acknowledge this risk","messagePattern":"(.+?) exposure mode 'open' allows arbitrary senders to trigger the agent with operator credentials and local host access; set (.+?)=(.+?) to acknowledge this risk","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"libs/talon/deepagents_talon/channels/base.py","lineNumber":470,"sourceCode":"        return ExposureMode(value)\n    except ValueError as error:\n        modes = \", \".join(mode.value for mode in ExposureMode)\n        msg = f\"invalid {provider} exposure mode {value!r}; expected one of: {modes}\"\n        raise ValueError(msg) from error\n\n\ndef _require_open_acknowledgement(\n    env: Mapping[str, str],\n    config: ChannelExposureEnv,\n) -> None:\n    if env.get(config.open_ack) == config.open_ack_value:\n        return\n    msg = (\n        f\"{config.provider} exposure mode 'open' allows arbitrary senders to trigger the \"\n        \"agent with operator credentials and local host access; set \"\n        f\"{config.open_ack}={config.open_ack_value} to acknowledge this risk\"\n    )\n    raise ValueError(msg)\n\n\ndef _split_index(text: str, limit: int) -> int:\n    window = text[:limit]\n    for delimiter in (\"\\n\\n\", \"\\n\", \" \"):\n        index = window.rfind(delimiter)\n        if index > 0:\n            return index + len(delimiter)\n    return limit\n\n\ndef _media_type(path: Path) -> str:\n    mime, _ = mimetypes.guess_type(path)\n    if mime is None:\n        msg = f\"unsupported media file type: {path}\"\n        raise ChannelMediaError(msg)\n    if mime.startswith(\"image/\"):\n        return \"image\"","sourceCodeStart":452,"sourceCodeEnd":488,"githubUrl":"https://github.com/langchain-ai/deepagents/blob/a1af029e6e73cb17c36bff823d227747b28e91e1/libs/talon/deepagents_talon/channels/base.py#L452-L488","documentation":"Talon refuses to run a channel in 'open' exposure mode unless the operator explicitly acknowledges the risk. In open mode, anyone who can message the channel (e.g. any Telegram user) can trigger the agent, which executes with the operator's credentials and local host access. The check in `_require_open_acknowledgement` raises `ValueError` until the designated acknowledgement env var is set to its required value.","triggerScenarios":"Calling `channel_exposure_from_env` when the exposure mode resolves to 'open' (e.g. DEEPAGENTS_TALON_EXPOSURE=open) while the acknowledgement variable `config.open_ack` is missing or not equal to `config.open_ack_value`.","commonSituations":"Developers exposing a Telegram channel publicly for demos or quick tests forget the acknowledgement flag; CI or container environments set exposure=open via env vars without the ack; teams inherit configs from examples that used a restricted mode and switch to open without reviewing the security warning.","solutions":["Read the error text: it names the exact env var (`config.open_ack`) and required value (`config.open_ack_value`) — set that variable to that value to acknowledge the risk.","If you do not need public exposure, switch the exposure mode to a restricted mode (e.g. allowlist specific senders) instead of acknowledging open mode.","If exposure=open was set accidentally (e.g. inherited env var), unset or correct DEEPAGENTS_TALON_EXPOSURE."],"exampleFix":"// before\nDEEPAGENTS_TALON_EXPOSURE=open\n// after\nDEEPAGENTS_TALON_EXPOSURE=open\nDEEPAGENTS_TALON_OPEN_ACKNOWLEDGED=true  # exact var/value per config.open_ack / config.open_ack_value","handlingStrategy":"validation","validationCode":"import os\ndef is_open_exposure_acknowledged(ack_var: str, ack_value: str) -> bool:\n    return os.environ.get(ack_var) == ack_value\n# refuse to start the channel unless acknowledged","typeGuard":"def open_mode_acknowledged(env: dict[str, str], ack_var: str, ack_value: str) -> bool:\n    return env.get(ack_var) == ack_value","tryCatchPattern":"try:\n    exposure = channel_exposure_from_env(env)\nexcept ValueError as exc:\n    logging.error(\"channel startup refused: %s\", exc)\n    raise SystemExit(2)","preventionTips":["Treat exposure=open as a production-security decision requiring review, not a default","Store the acknowledgement var alongside the exposure var in your env template so they ship together","Prefer restricted/allowlist exposure modes unless public triggering is intentional","Add a startup smoke test in CI that catches unacknowledged open mode"],"tags":["security","configuration","env-var","channels"],"backgroundTag":"unsafe-exposure-mode-unacknowledged","analyzedSha":"a1af029e6e73cb17c36bff823d227747b28e91e1","analyzedAt":"2026-08-29T11:43:24.718Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}