Breaking

DeepSeek Harness Bug Let Agents Bypass Their File Sandbox

September 9, 2026 at 07:18 EDT

Security
AI Agents
Software Dev & Coding

A vulnerability in DeepSeek Harness let an agent running under the default file sandbox call the harness's local control interface, switch its session to danger-full-access, and continue without a human approval prompt. Tracked as CVE-2026-82533 and rated 9.4 on the CVSS scale, the issue affects DeepSeek Harness 0.1.1-rc.2 and earlier.

SEPTEMBER 9, 2026 · DEEPSEEK HARNESS

One command removed the boundary

A sandboxed agent could call its local control interface, switch to danger-full-access, and continue without a human approval prompt.

A one-step elevation path

The core proof used one shell command and produced no approval event.

1
shell command

0
approval prompts

9.4CVSS score

0.1.1-rc.2Affected and earlier

0.1.2-alpha.2First fixed npm release

How the boundary failed

Attacker text
untrusted content

→

Agent shell
command runs

→

Local API
trusted by header

→

Full access
sandbox bypassed

PATCH SCOPE

The control plane is tighter, but the file policy is unchanged

The fix adds a one-time startup token and signed cookie for interface calls. The documented sandbox still focuses on file effects; reads and network access remain outside that boundary.

Practical value

Local-first coding agent with composable tools, sessions, and plugins.

Security caveat

Developer-preview software with no security audit; do not rely on it as the only control.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.