DeepSeek Harness sandbox flaw lets AI agents disable own security, patch issued
A critical vulnerability in DeepSeek Harness, the open-source tool for running AI coding agents locally, allowed a sandboxed agent to disable its own sandbox with a single command, per OX Research. The flaw, tracked as CVE-2026-82533 and rated 9.4/10, can be triggered by prompt injection, turning any untrusted file into a potential workstation compromise. DeepSeek patched the issue on GitHub but the fix was delayed on npm.
Bottom line — CVE-2026-82533, rated 9.4, leaves 216,000+ GitHub-starred tool vulnerable to single-command sandbox escape.
Go deeper (7)
- The exploit worked by having the agent call the tool's local web interface, which lacked authentication, to switch its session to 'danger-full-access' mode, according to OX Research. The interface trusted the HTTP Host header instead of verifying the connection origin, per VulnCheck.
- Two developers had already reported the same behaviour on DeepSeek's discussion board on August 13 and 14, before the CVE was assigned, The Hacker News noted.
- DeepSeek fixed the code on GitHub on August 27 (version 0.1.2-alpha.1), but that release never reached the npm registry; the first fixed npm version was 0.1.2-alpha.2 on August 30, per The Hacker News. The current release is 0.1.2-rc.1.
- The same unauthenticated interface also allowed attackers to download all stored conversation logs without a key, VulnCheck's advisory stated.
- The sandbox only restricts file writes, not reads or network access, per the tool's own documentation. The project's safety notice warns that sandboxing and approval prompts 'do not guarantee isolation or prevent damage,' The Hacker News reported.
- The flaw adds to a growing pattern of AI coding agents escaping their sandboxes, with similar findings reported for tools from Anthropic and others this year, per DevOps.com.
- DeepSeek Harness has no security policy file and no private reporting channel, as noted by a developer on August 14, and the project's release notes did not flag the fix as a security update, per The Hacker News.