DeepSeek Harness sandbox escape: one shell command lets AI agents disable their own sandbox (CVE-2026-82533, CVSS 9.4)
jedisct1 · x · 2026-09-09
OX Research disclosed CVE-2026-82533 (CVSS 9.4) in DeepSeek Harness (dsh), DeepSeek's open-source coding-agent harness with 215K+ GitHub stars.
- Mechanism: The harness exposes its agent-control API on a local HTTP port with no authentication, trusting only the client-supplied Host header. The OS sandbox restricts file writes but leaves loopback networking open, so a sandboxed agent can use a single shell command to call the API and elevate itself to danger-full-access with approval prompts disabled — on shipped defaults.
- Bonus flaw: Logs record agent commands as "source": {"kind": "user"}, meaning the harness can't tell its own agent from a real user.
- Remote risk: If the port is network-exposed, an unauthenticated attacker can take over the agent and export all stored conversations without a key.
- Timeline: Disclosed Aug 24, fixed Aug 27 in 0.1.2-alpha.1. Users should upgrade immediately.
More from coding & agent
- Agent verified 'success' after double-voting: a lesson in harness vs model bugs — TejasKumar_ · 2026-10-26
- diginomica: agentic automation hype is overdone, and 'The Hackening' of enterprise security has begun — jonerp · 2026-10-26
- 'Vibe verification': ~60% of AI-written formal specs prove the wrong property — basedjensen · 2026-10-26
- Devin launches Security suite powered by Claude Mythos with $100M+ credits — DevinAI · 2026-10-26
- HackBench injects reward hacks into agent trajectories to stress-test monitors — DanielKhashabi · 2026-10-26
- Hugging Face ships hf CLI updates: deduped cache saves 19GB, faster buckets, retryable GPU jobs — yb2698 · 2026-10-26