langchain-ai/deepagents · error · ValueError

{config.provider} exposure mode 'open' allows arbitrary send

Error message

{config.provider} exposure mode 'open' allows arbitrary senders to trigger the agent with operator credentials and local host access; set {config.open_ack}={config.open_ack_value} to acknowledge this risk

What it means

Talon refuses to run a channel in 'open' exposure mode unless the operator explicitly acknowledges the risk. In open mode, anyone who can message the channel (e.g. any Telegram user) can trigger the agent, which executes with the operator's credentials and local host access. The check in `_require_open_acknowledgement` raises `ValueError` until the designated acknowledgement env var is set to its required value.

Source

Thrown at libs/talon/deepagents_talon/channels/base.py:470

        return ExposureMode(value)
    except ValueError as error:
        modes = ", ".join(mode.value for mode in ExposureMode)
        msg = f"invalid {provider} exposure mode {value!r}; expected one of: {modes}"
        raise ValueError(msg) from error


def _require_open_acknowledgement(
    env: Mapping[str, str],
    config: ChannelExposureEnv,
) -> None:
    if env.get(config.open_ack) == config.open_ack_value:
        return
    msg = (
        f"{config.provider} exposure mode 'open' allows arbitrary senders to trigger the "
        "agent with operator credentials and local host access; set "
        f"{config.open_ack}={config.open_ack_value} to acknowledge this risk"
    )
    raise ValueError(msg)


def _split_index(text: str, limit: int) -> int:
    window = text[:limit]
    for delimiter in ("\n\n", "\n", " "):
        index = window.rfind(delimiter)
        if index > 0:
            return index + len(delimiter)
    return limit


def _media_type(path: Path) -> str:
    mime, _ = mimetypes.guess_type(path)
    if mime is None:
        msg = f"unsupported media file type: {path}"
        raise ChannelMediaError(msg)
    if mime.startswith("image/"):
        return "image"

View on GitHub (pinned to a1af029e6e)

Solutions

1. Read the error text: it names the exact env var (`config.open_ack`) and required value (`config.open_ack_value`) — set that variable to that value to acknowledge the risk.
2. If you do not need public exposure, switch the exposure mode to a restricted mode (e.g. allowlist specific senders) instead of acknowledging open mode.
3. If exposure=open was set accidentally (e.g. inherited env var), unset or correct DEEPAGENTS_TALON_EXPOSURE.

Example fix

// before
DEEPAGENTS_TALON_EXPOSURE=open
// after
DEEPAGENTS_TALON_EXPOSURE=open
DEEPAGENTS_TALON_OPEN_ACKNOWLEDGED=true  # exact var/value per config.open_ack / config.open_ack_value

import os
def is_open_exposure_acknowledged(ack_var: str, ack_value: str) -> bool:
    return os.environ.get(ack_var) == ack_value
# refuse to start the channel unless acknowledged

def open_mode_acknowledged(env: dict[str, str], ack_var: str, ack_value: str) -> bool:
    return env.get(ack_var) == ack_value

try:
    exposure = channel_exposure_from_env(env)
except ValueError as exc:
    logging.error("channel startup refused: %s", exc)
    raise SystemExit(2)

When it happens

Trigger: Calling `channel_exposure_from_env` when the exposure mode resolves to 'open' (e.g. DEEPAGENTS_TALON_EXPOSURE=open) while the acknowledgement variable `config.open_ack` is missing or not equal to `config.open_ack_value`.

Common situations: Developers exposing a Telegram channel publicly for demos or quick tests forget the acknowledgement flag; CI or container environments set exposure=open via env vars without the ack; teams inherit configs from examples that used a restricted mode and switch to open without reviewing the security warning.

Related errors

• Cannot determine whether {str(left)!r} is {str(right)!r}: {e
• Repository root must be an absolute contained path: {root!r}
• Invalid {SERVER_ENV_PREFIX}ALLOW_FS_TOOLS value: unknown fil
• Invalid {SERVER_ENV_PREFIX}ALLOW_FS_TOOLS value: {raw!r}; ex
• allow_fs_tools must be None or a non-empty list

AI-assisted analysis of langchain-ai/deepagents@a1af029e6e (2026-08-29). Data as JSON: /api/errors/98e77d25072a77ee. Report an issue: GitHub.