A critical flaw, CVE-2026-82533 (CVSS 9.4), has been found in DeepSeek Harness — a popular open-source tool for running AI agents right on a developer machine. The tool runs the agent commands inside an OS-level sandbox so untrusted code cannot write outside the workspace. The problem: the agent itself could turn that sandbox off, and drop the approval prompts, with a single command — no password and no user consent. In effect, the protection switched itself off.
What happened
DeepSeek Harness confines file writes to the workspace but leaves reads and network open by default. Researchers at OX Research showed that one shell command was enough to break out: the agent called the tool local web interface and flipped the session into “danger-full-access” mode. In that mode the sandbox and the approval prompts were simply disabled.
The core mistake was that the interface had no authentication at all. The check relied on the HTTP Host header, and a comment right next to it in the code admitted this “is not an auth layer.” On top of that, approvals were only requested for privilege escalation, never for a session-mode change. So any local call sailed through.
Why it matters
To trigger the chain an attacker only had to get an instruction in front of the agent — for example, hidden inside a file the agent reads while doing its job. That is textbook indirect prompt injection: the agent cannot tell “data to work on” from “a command to run.” From there the full sandbox bypass followed.
The blast radius comes from which account the agent runs under — the same one that launched the tool. So a sandbox escape is not “the agent wrote a stray file”; it is potential full control of the developer machine, with all its keys and access. The sandbox was the only barrier here, and it came off with one line.
A quiet patch and a second hole
Versions 0.1.1-rc.2 and earlier are affected. The fix landed on 27 August (0.1.2-alpha.1 on GitHub, then npm from 0.1.2-alpha.2, with 0.1.2-rc.1 on 3 September carrying it). It was done right: the tool now prints a one-time token at startup, the browser trades it for a signed cookie, and every interface call requires that cookie.
What is off-putting is that DeepSeek shipped the fix with no security advisory and no CVE mention — just a line in a routine changelog. And alongside it researchers found an unauthenticated endpoint that served full session logs, i.e. the entire conversation with the agent, with no key. For a project with 216,000+ GitHub stars, that silence is a poor look.
Not an isolated case
This is part of a wider 2026 pattern: AI-agent sandbox escapes keep landing one after another. Earlier work showed a malicious repository configuration making an agent execute code outside its isolation, and prompt injection from emails and documents has already exfiltrated data from production systems. Tellingly, DeepSeek own documentation warns that sandboxing “does not guarantee isolation or prevent damage.”
The root is always the same: an agent is a privileged executor driven by text, and any attacker-controlled text in its view becomes a potential command. That is why an agent needs the same checks and balances as a privileged user, enforced technically.
What to do
- Update DeepSeek Harness to 0.1.2-rc.1 or later; for third-party desktop wrappers, check which version they bundle.
- Until you patch, disable the web interface when it is not in use and remove any port tunnels or proxies to it.
- Do not run AI agents under a privileged account and do not hand them secrets “just in case” — less access means less damage on escape.
- Do not treat the agent sandbox as your only barrier. Test how your agents can be tricked before an attacker does, with AI agent penetration testing and prompt injection testing, and bake the risks in early with agentic AI threat modeling.
- Review the code paths where agents execute tool output with a secure code review, validate the full break-in path with LLM application penetration testing and red team operations.
The takeaway
The DeepSeek Harness story is a reminder that a sandbox is worth only as much as its resistance to being switched off from the inside. When the single barrier drops to one password-less command, there is no isolation at all. If you run AI agents, assume attackers will try to trick them through input, and test that before someone else does — start with an AI agent penetration test.