DeepSeek Harness Flaw Lets AI Agents Bypass File Sandbox (CVE-2026-82533)

A critical vulnerability in DeepSeek Harness, the open-source tool DeepSeek ships for running AI coding agents on a developer's machine, allowed a malicious prompt to disable the agent's file sandbox in a single command. Tracked as CVE-2026-82533 and rated 9.4 out of 10 by VulnCheck, the flaw was reported by security firm OX Research and patched by DeepSeek on August 27 after affecting version 0.1.1-rc.2 and earlier releases. Under default configuration, Harness confines agent writes to a workspace and a temporary directory, but the vulnerability let attacker-supplied text prompt the agent to flip its own session into a mode called danger-full-access.

The root cause sat in the tool's local web interface. According to OX Research, Harness exposes that interface to the sandboxed shell along with the current session identifier, so the agent already knows where to call. The check that gated requests only inspected the Host header the client supplied and never verified the connection's origin, even carrying a comment in the code that it "is not an auth layer." Because the sandbox only restricts files while leaving reads and network access open, an agent could reach the interface from inside its workspace. A single shell command invoked that local endpoint and switched the session into danger-full-access, which removes the sandbox and silences future approval prompts without ever requesting elevated privileges.

The exploit required text the agent processed, such as instructions in a file or repository, and worked on any default installation until the August 27 patch. Harness refuses to bind on all network interfaces by default, so reaching the interface from another host still required user action such as port forwarding, an SSH tunnel, or a tunnel opened by an editor. OX Research confirmed the sandbox was active beforehand by running two sessions from identical defaults against the same command: only the session that made the call escaped the workspace and wrote outside it. VulnCheck's advisory adds that the same unauthenticated interface served a request to download a session's complete log, meaning anyone reaching it could pull stored conversations without a key. Users should run a port scanner against local development hosts to confirm no Harness listener has been exposed via tunnels, and audit forwarded ports with awareness that any VPN or proxy path can extend the same reach.

For developers running DeepSeek Harness, the immediate remediation is to update past the patched release and audit any sessions created on vulnerable builds for signs of sandbox bypass. OX Research verified the issue by reproducing it on a default install, so teams should treat prior log archives as potentially exposed and rotate any secrets that an agent could have read. The episode also underlines how AI coding tools ship increasingly powerful local services that deserve the same scrutiny as any other network endpoint on a developer machine.