DeepSeek Harness Bug Let Agents Kill Sandbox in One Command
TL;DR
- OX Security named isTrustedApiRequest as the flawed function: it validates the Host header without comparing it to the actual TCP connection origin.
- The OS sandbox blocked file writes but left loopback networking unrestricted, giving the agent a direct path to the unauthenticated control-plane API.
- DeepSeek confirmed the fix in three days: vulnerability flagged August 24, patch released August 27, fix verified August 30.
DeepSeek Harness, an open-source tool for running AI coding agents locally, shipped for weeks with a sandbox that a sandboxed agent could disable with one command. VulnCheck tracked the flaw as CVE-2026-82533 and rated it 9.4 out of 10, The Hacker News reported on Sept 9.
The escape worked because the tool's local web interface, reachable by the agent from inside the sandbox, required no credentials. Calling that interface flipped the agent's session into a mode named "danger-full-access," which switched off both the sandbox and the approval prompts. According to OX Research, which reported the flaw to VulnCheck on Aug 24, "one shell command was enough" to trigger it. A check in the tool's source code that read the HTTP Host header was labelled in the code itself as one that "is not an auth layer."
Two developers had already flagged the same behaviour on DeepSeek's discussion board on Aug 13 and Aug 14, before a CVE existed. DeepSeek fixed the code on GitHub on Aug 27 in version 0.1.2-alpha.1, but that release never reached npm. The first fixed version to hit the registry was 0.1.2-alpha.2 on Aug 30; the current release, 0.1.2-rc.1, went out Sept 3. Versions 0.1.1-rc.2 and earlier are still exposed.
The patch replaces the Host-header check with token-based auth: the tool prints a one-time token at startup, and the browser exchanges that token for a signed cookie. The repository's own security notice already warned that the software "has not undergone a security audit" and that "sandboxing and approval prompts do not guarantee isolation or prevent damage."
Agent-security bugs are stacking up this week; it slots alongside our recent cybersecurity coverage of a Google Threat Intelligence report on an autonomous multi-agent framework that harvested credentials in under six hours.
What others are reporting
-
OX Security Read →
Original disclosure; includes proof-of-concept, root cause analysis of the flawed isTrustedApiRequest function, and verified sandbox confinement before and after the escape.
A single command was enough. From inside the sandbox, the agent could call the harness's own unauthenticated API and elevate its session to 'danger-full-access'
-
DevOps.com Read →
Adds confirmed timeline (Aug 24 flag, Aug 27 patch, Aug 30 verified fix) and broader framing citing similar harness escape patterns at OpenAI, Anthropic, and Meta.
-
OffSeq Threat Radar Read →
Structured CVE record classifying the flaw as CWE-642, CVSS 9.4 under v4.0 scoring, confirming all versions before 0.1.2-alpha.1 are affected.
the local HTTP control-plane API validates only the client-supplied Host header rather than the actual TCP connection origin
Originally reported by thehackernews.com
Read the original article →Original headline: DeepSeek Harness CVE-2026-82533 Let Sandboxed Agents Turn Off Their Own Sandbox With One Shell Command