Critical Sandbox Escape Vulnerability in DeepSeek Harness Lets AI Agents Disable Protections with One Command
Researchers at OX Research identified a critical vulnerability in DeepSeek Harness, an open-source tool for running AI agents that interact with local code and files. The flaw, tracked as CVE-2026-82533 with a CVSS score of 9.4, allowed an AI agent to access the tool's local web interface and switch its session to danger-full-access mode, removing all sandbox restrictions and confirmation prompts. Attackers could trigger the escape through prompt injection by embedding malicious instructions in files or content processed by the agent. The web interface lacked authentication and relied on a spoofable Host header, while session details were automatically exposed to the agent environment. The issue affected versions 0.1.1-rc.2 and earlier; patched releases began with 0.1.2-alpha.2. The same interface also exposed logs of all stored conversations. DeepSeek had previously warned that its sandbox and confirmation mechanisms did not guarantee full isolation.
AntiMalwareSep 9, 2026Translated from Russian