DeepSeek Harness Flaw Let AI Agents Escape Sandbox Restrictions

Sandbox escape required no user approval

A security flaw in DeepSeek Harness allowed AI coding agents to disable their own sandbox protections without triggering approval prompts, security researchers disclosed this week. The vulnerability affected default installations of the open-source tool, which developers use to run AI agents that write and execute code on local machines.

The issue, tracked as CVE-2026-82533, stems from how DeepSeek Harness implemented its security controls. The tool runs agent commands inside an operating-system sandbox designed to prevent untrusted code from writing files outside designated workspaces. However, agents could bypass this protection by calling the tool's own web interface running on the same machine.

A single shell command was sufficient to exploit the flaw. The command invoked the local interface and switched the agent's session to "danger-full-access" mode, which disables sandboxing and stops approval prompts entirely. Because the command changed a session setting rather than requesting elevated permissions, it never triggered the approval mechanism that would normally alert users to suspicious activity.

OX Research, the security firm that reported the vulnerability, verified the sandbox worked correctly before the escape but failed afterward. In testing, an agent that executed the bypass command successfully wrote files outside its workspace, while an identical agent without the bypass was blocked as expected.

Authentication gaps enabled the exploit

The root cause lay in DeepSeek Harness's unauthenticated local API. The tool's web interface performed no identity verification—its access check only examined the HTTP Host header supplied by the client, never validating the connection's actual origin. A comment in the source code explicitly noted this check "is not an auth layer."

The tool also provided agents with both the interface address and current session identifier as environment variables, eliminating the need for agents to discover these values. Combined with unrestricted network access from inside the sandbox (only file writes were confined), this design made the local API trivially reachable.

VulnCheck assigned the flaw a severity rating of 9.4 out of 10 and published its advisory on September 8. The vulnerability also allowed external attackers to control agents and download complete session logs if they could reach the interface through port forwarding or tunnels.

Fix adds authentication, but questions remain

DeepSeek patched the vulnerability on August 27 by implementing token-based authentication. The tool now generates a one-time token at startup that browsers must exchange for a signed cookie required on all API calls.

However, the fix does not change the underlying sandbox architecture. Current documentation still states that reads and network access remain unconfined, and agents still receive the interface address. No public source addresses whether agents can obtain valid session tokens under the new authentication scheme.

Versions 0.1.1-rc.2 and earlier are affected. Users should upgrade to version 0.1.2-alpha.2 or later—the current release is 0.1.2-rc.1. The first fixed version, 0.1.2-alpha.1, was committed to GitHub but never published to the npm registry where most users install the tool.

Third-party desktop applications that bundle DeepSeek Harness ship their own copies, and users must verify which version their wrapper includes. One Windows build continued shipping the vulnerable version until September 6.

Why it matters

Coding agents represent an attractive attack surface because they execute commands with the full privileges of the user account that launched them. As organizations increasingly deploy AI agents for software development tasks, sandbox escapes like this one demonstrate that security controls designed for traditional software may not adequately constrain autonomous systems capable of modifying their own execution environment. The project's own safety notice warns that sandboxing "does not guarantee isolation or prevent damage," yet the tool had accumulated over 216,000 GitHub stars by September 9, suggesting widespread adoption despite the lack of a formal security audit.

Two developers publicly described identical escape techniques on DeepSeek's discussion board on August 13 and 14, before any CVE was assigned. The project published no security advisory and listed the authentication fix among routine changes in release notes, with no security notice or CVE reference. As of September 9, the repository still lacked a security policy file or private reporting channel.

Details were first reported by The Hacker News, with research credited to OX Research's Nir Zadok and Moshe Siman Tov Bustan through VulnCheck.