DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval
A vulnerability in DeepSeek Harness, an open-source tool for running AI coding agents, allows a sandboxed agent to disable its sandbox and bypass approval prompts by accessing the tool's local web interface. Researchers discovered this escape multiple times throughout August, and a fix was released on September 6, but not all users have received the updated version. The tool itself has not undergone a security audit and doesn't provide a mechanism for reporting flaws.
A flaw in DeepSeek Harness, a tool for running AI coding agents on a developer's machine, has been discovered that allows a sandboxed agent to disable its sandbox and bypass approval prompts. The vulnerability was reported by OX Research, who assigned the identifier CVE-2026-82533, and rated the flaw a 9.4 out of 10. The tool runs an agent's commands inside an operating-system sandbox, designed to prevent untrusted files from writing outside its workspace. However, the agent could reach the tool's local web interface and, with a single command, set its session to a mode called danger-full-access, effectively disabling the sandbox and stopping approval prompts.
Researchers had repeatedly found coding agents escaping their sandboxes this year, including a set of flaws in which a repository's own configuration caused agents to run attacker code outside their sandboxes. Two developers described the same escape on DeepSeek's own discussion board before the CVE existed, with one posting a report showing a process still held by the sandbox reaching the local interface and then switching the session to danger-full-access. The tool's local interface had no authentication, trusting a header supplied by the client and not verifying its origin.
DeepSeek Harness has not undergone a security audit and doesn't provide a mechanism for reporting flaws. The vulnerability was fixed in version 0.1.2-alpha.2, but not all users have received the update. The project’s own safety notice states that sandboxing and approval prompts “do not guarantee isolation or prevent damage.”
**Affected Versions and What to Install:**
- Versions 0.1.1-rc.2 and earlier are affected.
- The fixed version is 0.1.2-alpha.2 (registry: 0.1.2-rc.1).
- Third-party desktop builds may ship different versions; check which version your build uses.
**What to Do:**
- Install 0.1.2-alpha.2 or later.
- If you installed through a third-party desktop app, check which version of the harness it ships.
- If you cannot upgrade, stop the web interface when you are not using it, and remove any tunnel, proxy, or port forward that reaches it.
**Companies:** DeepSeek **Threat Actors:** Not Specified **Malware:** Not Specified **Sectors:** Not Specified **Countries:** Not Specified **Products:** DeepSeek Harness **Tags:** vulnerability, sandbox, coding-agent, security-audit, exploit