Imagine the AI code agent that is working in the sandbox. It is expected to remain there. It can read files, run commands, and help you code, but it shouldn't be able to touch anything outside its little workspace.

Now imagine that agent reads a malicious file. The file tells it to run one command. The agent does. And just like that, the sandbox is gone. The agent is now running commands directly on your machine, with no approval prompts, no restrictions.

That's not a hypothetical. That's exactly what happened with DeepSeek Harness, an open-source tool for running AI coding agents locally. The flaw is tracked as CVE-2026-82533. It carries a CVSS score of 9.4 out of 10.

The Hacker News reported on the flaw, citing research from OX Research and a CVE record published by VulnCheck on September 8. It was fixed on August 27, 2026, but only if you know which version to install.

Let me break it down.

Quick Summary

What Went Wrong?

DeepSeek Harness runs an AI agent's commands inside an operating-system sandbox. The idea is simple: if the agent is working with untrusted files, it can't write outside its workspace.

But the tool also has a local web interface. That interface lets you control sessions, change settings, and download logs. It's meant for the human operator.

The problem? The sandbox only confined file writes. Reads and network access were not confined. So the agent could still reach the local web interface. And that interface had no authentication.

The agent's shell was even given the address of the interface and the current session ID. It didn't have to hunt for them. They were handed over.

So the agent called the interface. It set its own session to a mode called danger-full-access. That mode turns off the sandbox and disables approval prompts. One command. That's all it took.

The Escape

Here's the sequence:

• You run DeepSeek Harness with default settings.
• The agent reads a file containing attacker-supplied text.
• That text tells the agent to call the local web interface.
• The agent does. The interface has no authentication.
• The agent sets its session to danger-full-access.
• The sandbox is now off. Approval prompts are off.
• The agent runs commands directly on your machine.
• The agent didn't break the sandbox. It asked the tool to turn the sandbox off. And the tool said yes.

OX Research confirmed this by running two sessions. Both started with the same default settings. Both got the same command. The session that made the call wrote to a folder outside its workspace. The other session was blocked.

That's how they proved the escape was real.

Why the Sandbox Didn't Stop It

The sandbox only covered files. The tool's own documentation for the affected release says that under default settings, writes stay inside the workspace and temporary folders. But reads and network access are not confined.

That left the local web interface reachable from inside the sandbox.

The interface also had a weak access check. It looked at the request's Host header. It never looked at where the connection actually came from. A comment in the code even says the check "is not an auth layer."

Because it trusted a header the client supplies, a machine outside could claim to be local and drive the agent. The tool's command line refused to listen on all network interfaces, so reaching it from outside needed a tunnel, SSH forward, or port forward. But from inside the sandbox, it was wide open.

The same interface also served a request to download a session's entire log. According to VulnCheck's advisory, anyone who could reach the interface could retrieve all stored conversations without a key.

Who's Affected and What to Install

Versions 0.1.1-rc.2 and earlier are affected. The fix landed on GitHub as 0.1.2-alpha.1 on August 27. But that version was never published to npm and npm is where the project's own instructions send users.

The Hacker News checked the npm registry on September 9 and confirmed that the first published release with the authentication change is 0.1.2-alpha.2, three days after the fix was pushed to GitHub.

If you installed through a third-party desktop app, check which version of the harness it ships. One Windows build pinned 0.1.1-rc.2 in late August and moved to 0.1.3-alpha.1 on September 6. Wrapper maintainers choose which copy to bundle, so you need to verify.

If you can't upgrade, stop the web interface when you're not using it. Remove any tunnel, proxy, or port forward that reaches it. And don't rely on limiting the address the tool listens on, the agent is already on the same machine.

What the Fix Does (and Doesn't)

The fix adds an identity check to the interface. The tool now prints a one-time token at its startup address. The browser exchanges that token for a signed cookie. Every call to the interface requires the cookie.

That closes the unauthenticated access hole.

But the fix does not change the sandbox. In 0.1.2-rc.1, the same reference still says reads and network access are not confined. The agent's shell still receives the interface address. No source says whether an agent running inside its workspace can still obtain a valid session under the new scheme.

So the escape is patched. The underlying design, an agent that can reach its own control interface is not fully addressed.

Community Reports Described the Same Escape

Two developers described the same escape on DeepSeek's own discussion board before the CVE existed.

On August 13, one posted a report showing a process still held by the sandbox reaching the local interface and then switching the session to danger-full-access, with test output.

On August 14, another posted a report on the same interface, listing the requests it accepted without any credentials. That second report also noted that the project had no security policy file and no private way to report a flaw. The project still has no security policy file.

OX Research reported the flaw to VulnCheck on August 24. VulnCheck credits Nir Zadok and Moshe Siman Tov Bustan.

The Hacker News checked the repository's advisory list on September 9 and found no security advisory published. The release that carried the fix lists it among routine changes, as removing an old transport and requiring "one-time-token authentication for network access," with no security notice and no mention of the CVE.

What You Should Do

• Check your version. If you're on 0.1.1-rc.2 or earlier, upgrade to 0.1.2-alpha.2 or later.
• Check third-party builds. If you installed through a desktop wrapper, find out which harness version it ships.
• Stop the web interface when you're not using it.
• Remove tunnels, proxies, or port forwards that reach the interface.
• Don't rely on the sandbox alone. The project's own safety notice says the software has not undergone a security audit. Sandboxing and approval prompts "do not guarantee isolation or prevent damage."

The Bigger Picture

DeepSeek Harness is popular. Its repository had more than 216,000 stars on September 9. That's a count of bookmarks, not installations but it shows how many developers are paying attention.

Coding agents are worth attacking because they hold a shell. DeepSeek Harness runs an agent's commands under the account that started it. If the agent escapes, it inherits that account's access.

This isn't the first time researchers have found coding agents escaping their sandboxes. Earlier this year, a set of flaws let a repository's own configuration cause agents to run attacker code outside their sandboxes.

The pattern is clear: sandboxes are hard. Approval prompts are not a silver bullet. And local control interfaces can become escape hatches if they're not properly secured.

The Bottom Line

DeepSeek Harness had a critical sandbox escape. An AI agent could call the tool's own local web interface, set itself to danger-full-access, and run commands outside the sandbox, all with one command. The flaw is CVE-2026-82533, CVSS 9.4.

The fix adds authentication to the interface. But the sandbox still doesn't confine reads or network access. If you use DeepSeek Harness, upgrade to 0.1.2-alpha.2 or later. Check third-party builds. And remember: don't trust the sandbox as your only line of defense.

What You Need to Know:

What You Need to Do:

1. Upgrade to 0.1.2-alpha.2 or later.
2. Check third-party desktop builds.
3. Stop the web interface when not in use.
4. Remove tunnels, proxies, and port forwards.
5. Don't rely on the sandbox alone.

FAQ Section

What is CVE-2026-82533?

A critical flaw in DeepSeek Harness that let a sandboxed AI agent disable its own sandbox with a single command. It carries a CVSS score of 9.4.

How did the escape work?

The agent called the tool's local web interface, which had no authentication, and set its session to danger-full-access. That turned off the sandbox and approval prompts.

Which versions are affected?

Versions 0.1.1-rc.2 and earlier. The first fixed release on npm was 0.1.2-alpha.2.

Is the vulnerability patched?

Yes, although the patch is in form of adding tokenized authentication to the web interface, but does not limit reads or network access for the sandbox.

If I am using DeepSeek Harness, what do I need to do?

Please update to version 0.1.2-alpha.2 or later, inspect the third-party builds, stop the web interface when it is not being used, and Remove all tunnels and proxies to it.

Source: The Hacker News