Report vulnerabilities through GitHub private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability. Please do not open public issues for security problems.

• Generated Python. The coding tool runs model-written Python as your user, in a subprocess on the agent host, with network and filesystem access. The execution timeout is not a sandbox, and child processes that detach from the worker's process group can outlive it.
• Tool router and GPU workers. These services are unauthenticated. The router binds to 127.0.0.1 by default (services.server.host), as do the SAM 3, OCR and Depth Anything 3 workers. Keep them on loopback or a private network: anyone who can reach them can use your GPUs, model endpoints and Serper key. The agent executes Python returned by the router at TOOL_SERVER_URL, so point it only at a router you run.
• Run directories. Evaluation reads pickle caches from the run directory, so evaluate only run directories you trust.
• Environment files. openvlharness-eval loads ./.env from the working directory, so run it only from directories you trust.

• The main model endpoint receives question text, images and tool evidence. The auxiliary model receives search results, webpage text and the images being searched.
• Serper receives search queries and the URLs of visited webpages, which it fetches.
• Reverse image search uploads query images to your S3 or GCS bucket as tool-uploads/<sha256>.<ext> and sends Serper a signed URL valid for one hour. The uploaded objects are not deleted; add a lifecycle rule to the bucket.
• Search tools download result images from their source sites, and the agent downloads HTTP(S) images given in the question or in tool arguments.
• With openvlharness-eval, the judge endpoint in --judge-config receives each question, its reference answer and the model's response. The paper uses GPT-4o for search and deep-research judging.