DeepSeek Harness Sandbox Escape Vulnerability Exposes Developer Workstations

A critical security vulnerability in DeepSeek Harness, an open-source AI agent runtime, has allowed sandboxed AI agents to bypass file system restrictions and gain full access to host machines. The flaw, tracked as CVE-2026-82533, effectively removes the primary security boundary designed to protect developers from malicious external inputs.

The vulnerability carries a CVSS score of 9.4, reflecting its high severity. Research from OX Security indicates the flaw allowed an agent to elevate its session to "danger-full-access" mode by calling the tool's unauthenticated local API via a single shell command. Once this mode was activated, the agent could write files anywhere on the host machine without triggering approval prompts. OX Research noted that "the confined command ran without a prompt and lifted its own confinement."

The Technical Failure

DeepSeek Harness (dsh) is designed as a local-first framework that enables AI models to operate as autonomous agents with shell access. To mitigate the risks of agents handling untrusted files, the system employs OS-level sandboxing, utilizing Seatbelt on macOS and bubblewrap or Landlock on Linux.

However, while these tools restricted file system access, they left loopback networking open. This allowed agents to communicate with the harness's own control-plane API on the same machine. The vulnerability stemmed specifically from the `isTrustedApiRequest` function. Instead of verifying the actual peer address of the request, the function relied on the client-supplied "Host" header to determine trust. By spoofing this header, a sandboxed agent could trick the system into granting it administrative privileges.

Industry Implications

This escape is particularly dangerous because coding agents typically operate with the ambient authority of the developer. If an agent is prompted by attacker-supplied text—such as a malicious git repository—it could potentially access sensitive SSH keys, cloud credentials, and internal corporate systems. By breaking the sandbox, the vulnerability transforms a restricted AI tool into a direct vector for workstation compromise.

Current Status

DeepSeek has addressed the flaw in version 0.1.2-alpha.1 of the DeepSeek Harness. Users of the framework are urged to update immediately to ensure that the `isTrustedApiRequest` function properly validates requests. Security professionals continue to monitor the deployment of the fix across the open-source community to prevent the exploitation of legacy installations.