DeepSeek Harness sandbox escape: one shell command lets AI agents disable their own sandbox (CVE-2026-82533, CVSS 9.4)
jedisct1 · x · 2026-09-09
OX Research disclosed CVE-2026-82533 (CVSS 9.4) in DeepSeek Harness (dsh), DeepSeek's open-source coding-agent harness with 215K+ GitHub stars.
- Mechanism: The harness exposes its agent-control API on a local HTTP port with no authentication, trusting only the client-supplied Host header. The OS sandbox restricts file writes but leaves loopback networking open, so a sandboxed agent can use a single shell command to call the API and elevate itself to danger-full-access with approval prompts disabled — on shipped defaults.
- Bonus flaw: Logs record agent commands as "source": {"kind": "user"}, meaning the harness can't tell its own agent from a real user.
- Remote risk: If the port is network-exposed, an unauthenticated attacker can take over the agent and export all stored conversations without a key.
- Timeline: Disclosed Aug 24, fixed Aug 27 in 0.1.2-alpha.1. Users should upgrade immediately.
More from coding & agent
- Teknium says missing /review subagent is back — update to restore it — Teknium · 2026-09-09
- IndeHub Chapter 16: hands-on session on building, shipping and monetizing apps with AI agents — rudrank · 2026-09-09
- Users want AI assistants to talk to each other, but lock-in makes it unlikely — mobileraj · 2026-09-09
- SmartGallery DAM adds ComfyUI Queue Deck: live previews, hardware telemetry, open source — Fit-Construction-280 · 2026-09-09
- Codus terminal-swarm coding tool hits Windows, orchestras hundreds of agents on your existing Claude/Codex subscription — Scobleizer · 2026-09-09
- Demo: install agentgateway on a Raspberry Pi in under 60s to track OpenAI token spend — bibryam · 2026-09-09