DeepSeek Harness Flaw Allowed Agents to Disable Security Controls

A significant security vulnerability in DeepSeek Harness, an open-source tool for running AI coding agents, allowed sandboxed agents to disable their own security controls without user approval. This flaw, tracked as CVE-2026-82533, effectively let a single command remove the barriers that prevent agents from writing files outside their designated workspace. The issue was present in default installations until a fix was released on August 27.

The vulnerability worked because the tool's local web interface, which controls the agent's session, lacked proper authentication. An agent could call this interface to switch its mode to "danger-full-access," a setting that turns off the file sandbox and disables approval prompts for broader commands. Since the interface trusted headers supplied by the client rather than verifying the connection's origin, it failed to distinguish between internal and external requests, creating a critical gap in the security model.

The Escape Mechanism

Security firm OX Research demonstrated that the escape required only one shell command. This command invoked the tool's local interface to change the session settings. Because the interface served the agent's shell with its own address and session identifier, the agent did not need to discover these details manually. Once the mode was changed, the agent could write to folders outside its workspace, whereas a control session without the call was correctly blocked.

The flaw was rated 9.4 out of 10 by VulnCheck, which assigned the CVE identifier. The rating reflects the high impact of allowing an agent to bypass its intended restrictions. The tool's documentation noted that while file writes were confined by default, reads and network access were not. This left the tool's own interface reachable from inside the sandbox, allowing the agent to exploit the lack of authentication to escalate its permissions.

External Access Risks

The vulnerability extended beyond the local machine. Because the interface check read the request's Host header but never looked at where the connection originated, an external machine could claim to be local. While the tool refused to listen on all network interfaces by default, users who forwarded or proxied the port through tunnels, SSH, or editors could expose the interface. This allowed remote attackers to drive the agent and potentially retrieve all stored conversations without a key.

The same interface also served requests to download a session's entire log. This meant that a caller who reached the interface could access all stored conversations. The lack of authentication in this area represents a significant data privacy risk, as sensitive coding sessions and potential credentials could be exposed to anyone who could reach the local endpoint.

Patch Availability and User Action

Versions 0.1.1-rc.2 and earlier are affected by the flaw. The fixed version, 0.1.2-alpha.1, was released on GitHub on August 27 but was not published to the npm registry, which is where most users install the tool. The first fixed release on npm was 0.1.2-alpha.2, published on August 30. The current npm release, 0.1.2-rc.1, includes the fix. Users should upgrade to 0.1.2-alpha.2 or later to mitigate the risk.

For those who cannot upgrade immediately, The Hacker News advises stopping the web interface when not in use and removing any tunnels, proxies, or port forwards that reach it. If the tool was installed through a third-party desktop app, users should check which version of the harness it ships. No source offers a way to stop the escape from inside the tool itself, making the upgrade the primary defense against this critical vulnerability.