Table of Contents
Introduction
A critical flaw in DeepSeek Harness — DeepSeek's open-source tool for running AI coding agents on a developer's machine — let a sandboxed agent turn off its own sandbox with a single command.
The vulnerability is tracked as CVE-2026-82533 and was rated 9.4 out of 10 by VulnCheck, which assigned the identifier and published the record on September 8, 2026.
A sandboxed AI agent could remove its own sandbox restriction with one command, allowing it to write outside its workspace without any approval prompt.
What Is DeepSeek Harness?
DeepSeek Harness is an open-source tool that runs an agent's commands inside an operating-system sandbox. This ensures that an agent working on untrusted files cannot write outside its workspace.
Key features:
- Runs AI coding agents on a developer's machine
- Sandboxes agent commands to prevent unauthorized writes
- Provides a web interface for agent management
- Has over 216,000 stars on GitHub
The tool runs an agent's commands inside an operating-system sandbox, so that an agent working on untrusted files cannot write outside its workspace.
The Vulnerability — One Command to Escape
According to OX Research, the security firm that reported the flaw, one shell command was enough to escape the sandbox.
The command did two things:
- Invoked the tool's local interface
- Set the agent's session to a mode called danger-full-access, which turns off the sandbox and stops approval prompts
The interface had no authentication. The check that determined whether a request could reach it read the request's Host header and never looked at where the connection originated.
How the Escape Worked
OX Research verified that the sandbox had been working before the escape by running two sessions from the same default settings and giving both the same command:
- Session 1: Made the call to the interface — was able to write to a folder outside its workspace
- Session 2: Did not make the call — was blocked from writing outside the workspace
Why it worked:
- Ordinary commands did not need approval to begin with
- Approval was only applied when a command requested broader access than the session already had
- The malicious call did not request broader access — it changed the session's setting instead
- The sandbox only covers files — reads and network access were not confined
- The tool's own interface was reachable from inside the sandbox
- The interface had no authentication
The tool also provides the agent's shell with the address of that interface and the current session's identifier, so the agent does not have to look for them.
Affected Versions and What to Install
| Version | Status | Released |
|---|---|---|
| 0.1.1-rc.2 and earlier | Affected | August 21 |
| 0.1.2-alpha.1 | Fixed, on GitHub only | August 27, not on npm |
| 0.1.2-alpha.2 | First fixed release on npm | August 30 |
| 0.1.2-rc.1 | Current npm release, carries the fix | September 3 |
What to do:
- Install 0.1.2-alpha.2 or later
- The registry's current release is 0.1.2-rc.1
- If you installed through a third-party desktop app, check which version of the harness it ships
- If you cannot upgrade, stop the web interface when not in use and remove any tunnel, proxy, or port forward that reaches it
No source reviewed offers a way to stop the escape from inside the sandbox on a default local installation while the tool is running. The agent is already on the same machine.
The Fix
The fix gives the interface an identity check:
- The tool now prints a one-time token at its startup address
- The browser exchanges that token for a signed cookie
- Every call to the interface requires the cookie
What the fix does not change:
- The sandbox still does not confine reads and network access
- The agent's shell still receives the interface address
- It is unclear whether an agent running inside its workspace can still obtain a valid session under the new scheme
Install 0.1.2-alpha.2 or later. The registry's current release is 0.1.2-rc.1.
Community Reports Described the Same Escape
Two developers described the same escape on DeepSeek's own discussion board before the CVE existed:
- August 13 — One developer posted a report showing a process still held by the sandbox reaching the local interface and then switching the session to danger-full-access, with test output
- August 14 — Another posted a report on the same interface, listing the requests it accepted without any credentials
The second report also noted that the project had no security policy file and no private way to report a flaw. The project still has no security policy file.
The release that carried the fix lists it among routine changes, as removing an old transport and requiring "one-time-token authentication for network access," with no security notice and no mention of the CVE.
Final Thoughts
The DeepSeek Harness sandbox escape is a significant security concern for developers using AI coding agents. It highlights the challenges of securing AI agents that have access to a shell and network resources.
Key takeaways:
- CVE-2026-82533 — rated 9.4 out of 10
- One command was enough to escape the sandbox
- No authentication on the tool's local interface
- Affected versions — 0.1.1-rc.2 and earlier
- Fixed versions — 0.1.2-alpha.2 or later (0.1.2-rc.1 is current)
- Third-party builds — check which version they ship
If your organization uses AI coding agents and needs assistance with security assessments or AI governance, contact SystemLogicIT for expert guidance.