DeepSeek Harness sandbox escape: one shell command lets AI agents disable their own sandbox (CVE-2026-82533, CVSS 9.4)
jedisct1 · x · 2026-09-09
OX Research disclosed CVE-2026-82533 (CVSS 9.4) in DeepSeek Harness (dsh), DeepSeek's open-source coding-agent harness with 215K+ GitHub stars.
- Mechanism: The harness exposes its agent-control API on a local HTTP port with no authentication, trusting only the client-supplied Host header. The OS sandbox restricts file writes but leaves loopback networking open, so a sandboxed agent can use a single shell command to call the API and elevate itself to danger-full-access with approval prompts disabled — on shipped defaults.
- Bonus flaw: Logs record agent commands as "source": {"kind": "user"}, meaning the harness can't tell its own agent from a real user.
- Remote risk: If the port is network-exposed, an unauthenticated attacker can take over the agent and export all stored conversations without a key.
- Timeline: Disclosed Aug 24, fixed Aug 27 in 0.1.2-alpha.1. Users should upgrade immediately.
More from coding & agent
- BELL: Open-Source Stack Combines Browserbase, Eve, iMessage and Stripe Link for Personal Agents — jeff_weinstein · 2026-10-27
- Legora runs 2,000 parallel agent evals on Modal Sandboxes for legal AI — blelbach · 2026-10-27
- Two engineers rebuilt a FedEx supplier's billing core in 3.5 months vs an estimated 7-8 — alex_verem · 2026-10-27
- GPT-6.1 Terra scores 48 on AA Coding Agent Index at one-third the cost of GPT-5.6 Terra — ArtificialAnlys · 2026-10-27
- Shift-1 router cuts coding agent spend up to 55% while keeping SWE-bench accuracy — ypatil125 · 2026-10-27
- Non-coder vibe-codes a Godot JRPG with Claude Code in two weeks, music and art synced — ADHDavid · 2026-10-27