A critical vulnerability in DeepSeek Harness, the open-source tool that runs AI coding agents on a developer’s machine, allowed a sandboxed agent to disable its own sandbox with a single command — no approval required. The flaw, tracked as CVE-2026-82533 and rated 9.4 out of 10 by VulnCheck, let an agent escape its filesystem isolation by calling the tool’s own unauthenticated web interface. DeepSeek fixed the issue on August 27, but the first patched release on npm did not arrive until August 30, leaving a window for exploitation on default installations.
The Sandbox Escape: One Command to Bypass All Restrictions
DeepSeek Harness runs agent commands inside an operating-system sandbox to prevent writes outside a designated workspace. The flaw, reported by OX Research and assigned a CVE on September 8, allowed an agent to remove that limit by sending a single shell command to the tool’s local web interface. That command set the agent’s session to a mode called danger-full-access, which turns off the sandbox and disables all approval prompts. Ordinary commands did not need approval in the first place; approval was only triggered when a command requested broader access than the session already had. The escape call did not request broader access — it changed the session’s setting directly, so no approval prompt appeared.
OX Research verified the escape by running two sessions under identical default settings. The session that executed the sandbox-disabling command wrote to a folder outside its workspace. The other session, which did not make the call, was blocked. The sandbox only covered files; the tool’s command-line reference for the affected release stated that “reads and network access are not confined.” That left the tool’s own interface reachable from inside the sandbox. The agent’s shell already received the interface address and the current session identifier, so it did not need to search for them.
How the Authentication Bypass Worked
The core of the vulnerability lay in the web interface’s authentication mechanism. The affected release checked whether a request could reach the interface by reading the HTTP Host header — a value supplied entirely by the client. The interface never examined where the connection actually originated. A comment in the relevant source file explicitly stated that the check “is not an auth layer.” This design allowed an attacker on the same machine to claim a local Host header and drive the agent. Even though the tool’s command line refused to listen on all network interfaces by default, reaching it from outside required the user to have forwarded or proxied the port through a tunnel, SSH forward, or an editor. On a default local installation, however, the agent was already on the same machine, so no extra steps were needed.
The same unauthenticated interface also served a request to download a session’s entire log. As VulnCheck’s advisory noted, any caller who reached the interface could retrieve all stored conversations without a key.
What is the DeepSeek Harness sandbox escape vulnerability (CVE-2026-82533)? CVE-2026-82533 is a high-severity authentication bypass in DeepSeek Harness that allows a sandboxed AI agent to disable its own filesystem sandbox. The agent sends a command to the tool’s unauthenticated local web interface, switching its session to danger-full-access mode, which removes write restrictions and approval prompts. The flaw relies on the interface trusting the Host header from the client rather than verifying the connection’s origin.
Affected Versions and the Patch Timeline
Versions 0.1.1-rc.2 and earlier are affected. The fixed version was initially marked as 0.1.2-alpha.1, but that version was never published to the npm registry, which is where the project’s installation instructions send users. The following table summarizes the release history:
- 0.1.1-rc.2 and earlier – Affected. Published August 21.
- 0.1.2-alpha.1 – Fixed on GitHub only. Released August 27, not on npm.
- 0.1.2-alpha.2 – First fixed release on npm. Released August 30.
- 0.1.2-rc.1 – Current npm release, carries the fix. Released September 3.
The Hacker News confirmed on September 9 that the first npm release with the authentication change was 0.1.2-alpha.2, three days after the fix was pushed to GitHub. Users upgrading should install 0.1.2-alpha.2 or later — the current release is 0.1.2-rc.1. For those who installed DeepSeek Harness through a third-party desktop app, checking which version the wrapper ships is essential. One Windows build pinned the vulnerable 0.1.1-rc.2 in late August and moved to 0.1.3-alpha.1 — which carries the fix — on September 6.
What the Fix Changes — and What It Does Not
The patch adds an identity check to the tool’s web interface. DeepSeek Harness now prints a one-time token at its startup address. The browser exchanges that token for a signed cookie, and every subsequent call to the interface requires that cookie. This prevents an agent from tampering with the session settings via the unauthenticated API.
What the fix does not address is the underlying sandbox architecture. In version 0.1.2-rc.1, the same reference still states that reads and network access are not confined, and the agent’s shell still receives the interface address. No source examined whether an agent running inside its workspace can still obtain a valid session under the new cookie scheme — meaning the fix closes one specific exploit path but does not fundamentally re-architect the sandbox.
Why a Coding-Agent Harness Is a Prime Target
A coding-agent harness is worth attacking because it holds a shell. DeepSeek Harness executes agent commands under the user account that started it. If an attacker can prompt the agent – through a malicious file or repository – to run the sandbox escape command, the agent then gains full write access outside its workspace. The project’s own safety notice, published in the repository, explicitly states that the software has not undergone a security audit and that sandboxing and approval prompts “do not guarantee isolation or prevent damage.” It warns users not to rely on the tool as their only security control for untrusted work.
Researchers have repeatedly found coding agents escaping their sandboxes this year. In one set of flaws, a repository’s own Git configuration caused agents to run attacker code outside their sandboxes. The DeepSeek Harness vulnerability is another illustration of the inherent risk in giving an AI agent even semi-privileged access to a local machine without rigorous authentication and isolation.
Community Reports Preceded the CVE
Two developers independently described the same sandbox escape on DeepSeek’s discussion board before the CVE was filed. On August 13, one user posted a report showing a process still bound by the sandbox reaching the local interface and switching its session to danger-full-access, complete with test output. The next day, another user posted a report listing the requests the interface accepted without any credentials. That second report also noted that the project had no security policy file and no private channel to report a flaw. As of September 9, the repository still lacks a security policy file. The August 14 report pointed out that the project had no way for researchers to privately disclose vulnerabilities — only public discussion boards were available.
OX Research reported the flaw to VulnCheck on August 24, according to its own timeline. VulnCheck credits Nir Zadok and Moshe Siman Tov Bustan. OX’s public disclosure does not mention the earlier community reports. The release that carried the fix, tagged dsh-v0.1.2-alpha.1, listed the change among routine updates – “remove old transport, add one-time-token authentication for network access” – with no security notice and no reference to the CVE. The repository’s advisory list contained no security advisory as of September 9.
Practical Steps for Users
Users running DeepSeek Harness should take the following actions:
- Install version 0.1.2-alpha.2 or later. The current npm release is 0.1.2-rc.1.
- If the harness was installed through a desktop wrapper, verify which version it ships. Wrapper maintainers may have pinned an older, vulnerable release.
- If upgrading is not immediately possible, stop the web interface when it is not in use, and remove any tunnels, proxies, or port forwards that expose the interface to the network.
- Note that limiting the address the tool listens on does not help on a default installation — the agent is on the same machine and can still reach the interface locally.
The August 13 community report confirmed that the escape works even when the tool is configured to listen only on localhost, because the agent’s process already runs on the same host. There is no known mitigation short of upgrading while the tool is running on a default local installation.
A Broader Pattern: The Challenge of Securing AI Agent Tooling
The DeepSeek Harness flaw is not an isolated incident. As AI coding agents become more widely used to automate tasks on developer machines, the security models around them remain immature. Sandboxes are often file-only, leaving network and API access unconfined. Authentication at the tool layer is frequently treated as optional or added as an afterthought. The fact that the tool’s own safety notice warns users not to trust it for isolation suggests the developers were aware of these gaps, yet the vulnerability existed in a publicly promoted release.
The open-source nature of the project means that third-party wrappers and integrations may not immediately reflect upstream fixes. The delay between the fix on GitHub (August 27) and the first npm release (August 30) left users exposed for several additional days. The lack of a security policy file and the absence of a private disclosure channel exacerbate the risk for the broader ecosystem.
For organizations evaluating AI coding agents for development workflows, this vulnerability reinforces the need to treat these tools as attack surfaces. Running agents with the full privileges of the user account, combined with weak sandboxing and unauthenticated local APIs, creates a realistic path for attackers who can supply malicious files or prompts. Until the industry develops more robust isolation patterns — such as mandatory network egress controls, per-run authentication tokens, and cryptographically enforced sandbox boundaries — each new agent harness will likely carry similar classes of vulnerabilities.
