DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval
DeepSeek Harness (CVE-2026-82533, CVSS 9.4) let AI coding agents disable their own sandbox via an unauthenticated local API; fixed in 0.1.2-alpha.2.
DeepSeek Harness versions 0.1.1-rc.2 and earlier allowed a sandboxed AI coding agent to turn off its own OS sandbox by calling the tool's unauthenticated local web interface, tracked as CVE-2026-82533 with a 9.4 CVSS from VulnCheck. A single command set the agent session to danger-full-access mode, removing sandboxing and approval prompts, and OX Research verified writes escaped the workspace. The interface trusted the client-supplied Host header with no authentication and could also return a session's entire conversation log. The fix adds a one-time token and signed-cookie check; the first npm release carrying it is 0.1.2-alpha.2, with 0.1.2-rc.1 current.
- Agent could invoke its own local API to set danger-full-access mode
- Reads and network access remain unconfined even in the fixed release
- Community reports of the same sandbox escape appeared August 13
- Wrapper-bundled builds may lag; users should verify the shipped version
- CVEs
- CVE-2026-82533
- Vendors
- DeepSeek
- Products
- DeepSeek Harness
- Organizations
- VulnCheckOX Research
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82533 | Host Header Authentication Bypass in DeepSeek Harness Local Control-Plane API | 9.4 | <1% |
From the original article
5 min read at thehackernews.com
A flaw in DeepSeek Harness, DeepSeek's open-source tool for running AI coding agents on a developer's machine, let a sandboxed agent turn off its own sandbox with a single command. The tool runs an agent's commands inside an operating-system sandbox, so that an agent working on untrusted files cannot write outside its workspace. The agent could remove that limit by calling the tool's own web
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.