Agent harnesses often start a small server (sandbox API, VS Code server, MCP-over-HTTP, dashboard) that can run commands. OpenHands' CVE-2026-112346 showed what happens when one is published on every interface with no key.

1. List what is listening: ss -tlnp (Linux), lsof -iTCP -sTCP:LISTEN -n -P (macOS), and docker ps --format "{{.Names}} {{.Ports}}". Anything agent-related on 0.0.0.0 or [::] is reachable from your network.
2. In Docker, publish as -p 127.0.0.1:PORT:PORT, never just -p PORT:PORT. Note that Docker's published ports can bypass ufw rules on Linux.
3. Set the harness's API key or token even when local, so another process or browser tab on the same machine can't drive it.
4. Keep long-lived provider and Git tokens out of agent secret stores where you can; use short-lived, scoped tokens and rotate any that sat on an exposed sandbox.