DeepSeek patches coding-agent sandbox escape in Harness

DeepSeek has fixed a flaw in its open-source Harness tool that allowed a sandboxed AI coding agent to disable its own file sandbox without an approval prompt. The vulnerability, tracked as CVE-2026-82533, affects version 0.1.1-rc.2 and earlier and received a 9.4 out of 10 rating from VulnCheck.

OX Research found that a single shell command could call Harness’s local web interface and change the active session to danger-full-access. That mode removes the file sandbox and stops approval prompts. The first fixed package published to npm was version 0.1.2-alpha.2 on August 30; the current npm release cited in the report is 0.1.2-rc.1.

A local interface bypassed the sandbox boundary

Harness is designed to run an agent’s commands inside an operating-system sandbox so untrusted work cannot write outside its workspace. OX Research tested two sessions with the same default configuration: the session that made the interface call wrote to a folder outside its workspace, while the other was blocked.

The boundary was incomplete by design. Harness’s command-line reference states that default file restrictions apply to writes, while reads and network access are not confined. The agent shell also received the local interface address and current session identifier, making the interface directly available from within the sandbox.

In the affected release, the interface had no authentication. Its access check examined the request’s Host header rather than the origin of the connection, and the project’s own code noted that this was not an authentication layer. A remote party could claim to be local if the interface had been exposed through a tunnel, SSH forward, proxy or editor integration.

Upgrade direct and bundled installations

The same interface could return a session’s complete log to callers that reached it, VulnCheck said. The command line does not listen on all network interfaces by default, but forwarded access can create an external path to the service. DeepSeek’s update introduces a one-time token at startup, which the browser exchanges for a signed cookie required on interface calls.

The update does not alter the stated sandbox model: reads and network access remain unrestricted in the cited reference, and the agent shell still receives the interface address. The source material does not establish whether an agent inside the workspace can obtain a valid session under the new authentication scheme.

Operational steps

• Install Harness 0.1.2-alpha.2 or later.
• Check desktop wrappers because they may bundle a separate Harness version.
• Stop the web interface when it is not needed if an upgrade is unavailable.
• Remove tunnels, proxies and port forwards that expose the local interface.

DeepSeek’s safety notice says the software has not undergone a security audit and that sandboxing and approval prompts do not guarantee isolation or prevent damage. Businesses using coding agents should verify the bundled Harness version, restrict interface exposure and avoid treating the agent sandbox as their only control for untrusted work.