Critical Sandbox Escape Vulnerability in DeepSeek Harness Lets AI Agents Disable Protections with One Command

Researchers at OX Research identified a critical vulnerability in DeepSeek Harness, an open-source tool for running AI agents that interact with local code and files. The flaw, tracked as CVE-2026-82533 with a CVSS score of 9.4, allowed an AI agent to access the tool's local web interface and switch its session to danger-full-access mode, removing all sandbox restrictions and confirmation prompts. Attackers could trigger the escape through prompt injection by embedding malicious instructions in files or content processed by the agent. The web interface lacked authentication and relied on a spoofable Host header, while session details were automatically exposed to the agent environment. The issue affected versions 0.1.1-rc.2 and earlier; patched releases began with 0.1.2-alpha.2. The same interface also exposed logs of all stored conversations. DeepSeek had previously warned that its sandbox and confirmation mechanisms did not guarantee full isolation.

AntiMalwareTranslated from Russian

Read at source

Security researchers from OX Research have disclosed a high-severity vulnerability in DeepSeek Harness, an open-source framework designed to let AI agents safely work with code and files on a developer’s local machine.

The flaw, assigned CVE-2026-82533 and rated 9.4 out of 10, enabled an AI agent to disable its own protective sandbox using a single command. In normal operation, the sandbox prevents the agent from writing data outside its designated working directory and requires explicit user confirmation for sensitive actions.

By sending a request to the tool’s local web interface, the agent could switch its active session into danger-full-access mode. This change instantly removed all write restrictions and eliminated confirmation prompts. The attack could be initiated via prompt injection: an adversary would embed a malicious instruction inside a file or other content that the agent later analyzed.

The web interface did not require any authentication. Trust decisions were based solely on the Host header, which an attacker could spoof. In addition, the interface address and current session identifier were automatically passed into the agent’s environment variables, making exploitation straightforward.

The vulnerability impacted all versions up to and including 0.1.1-rc.2. A fix was published on GitHub on 27 August, with the first protected npm release being 0.1.2-alpha.2. The current stable build, 0.1.2-rc.1, also contains the patch. Developers are advised to update at minimum to 0.1.2-alpha.2 and to audit any third-party wrappers that embed Harness.

When an update is not feasible, users should disable the web interface entirely and remove any proxies, tunnels, or port forwards that expose it. Researchers also noted that the same unauthenticated interface could be used to download logs of every stored conversation.

DeepSeek had previously stated that its sandbox and confirmation mechanisms do not provide complete isolation, underscoring the need for additional hardening when running AI agents with local system access.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in AI Security

Logical Argument Claims Full Alignment of Superintelligent AGI Is Fundamentally Impossible
Claude Account Bans Linked to IP Reputation, Device Environment and Payment Channels, But No Confirmed Formula
Local LLMs in AppSec: What Open Tools and Models Can Handle in Application Security