DeepSeek Harness Bug Let Agents Kill Sandbox in One Command

DeepSeek Harness, an open-source tool for running AI coding agents locally, shipped for weeks with a sandbox that a sandboxed agent could disable with one command. VulnCheck tracked the flaw as CVE-2026-82533 and rated it 9.4 out of 10, The Hacker News reported on Sept 9.

The escape worked because the tool's local web interface, reachable by the agent from inside the sandbox, required no credentials. Calling that interface flipped the agent's session into a mode named "danger-full-access," which switched off both the sandbox and the approval prompts. According to OX Research, which reported the flaw to VulnCheck on Aug 24, "one shell command was enough" to trigger it. A check in the tool's source code that read the HTTP Host header was labelled in the code itself as one that "is not an auth layer."

Two developers had already flagged the same behaviour on DeepSeek's discussion board on Aug 13 and Aug 14, before a CVE existed. DeepSeek fixed the code on GitHub on Aug 27 in version 0.1.2-alpha.1, but that release never reached npm. The first fixed version to hit the registry was 0.1.2-alpha.2 on Aug 30; the current release, 0.1.2-rc.1, went out Sept 3. Versions 0.1.1-rc.2 and earlier are still exposed.

The patch replaces the Host-header check with token-based auth: the tool prints a one-time token at startup, and the browser exchanges that token for a signed cookie. The repository's own security notice already warned that the software "has not undergone a security audit" and that "sandboxing and approval prompts do not guarantee isolation or prevent damage."

Agent-security bugs are stacking up this week; it slots alongside our recent cybersecurity coverage of a Google Threat Intelligence report on an autonomous multi-agent framework that harvested credentials in under six hours.