DeepSeek's Agent Harness Let the Model Drop Its Own Sandbox

OX Security published the write-up on 8 September. DeepSeek Harness, the company’s local coding-agent shell, had a hole in how it decided a request was safe. A sandboxed agent could turn its own confinement off. No stolen password. No open port on the internet. Default settings.

VulnCheck tagged it CVE-2026-82533 and scored 9.4. The fix is DeepSeek Harness 0.1.2-alpha.1, shipped 27 August. If you installed dsh in the first weeks it went viral and never upgraded, that is the story. This is not a how-to. It is a look at why “the model runs locally, so we are fine” keeps failing the same way.

What Harness actually is

DeepSeek Harness, dsh, is a local-first runner for coding agents. OX’s disclosure is the clean description: a browser UI in front of a local HTTP API on 127.0.0.1:3080, plugin architecture, tagline “Everything is a Plugin.” It landed in August 2026 and passed 215,000 GitHub stars in weeks. That number is why a default-install bug matters. Stars are not production. They are a map of who cloned the thing on a laptop that also holds the company repo.

If you live in Cursor you already know the pitch. Put a model next to the files. Let it run commands. Keep a sandbox so “refactor this” cannot become “rewrite the rest of the disk.” Harness sold the local version of that pitch. The model does not have to leave the machine. The machine still has to refuse the model.

We have been writing the agent-autonomy file all year, including agents that write their own code. The pattern underneath is boring. Tooling ships with a boundary that looks like a boundary in the README and behaves like a setting the model can flip.

The bug is a trust check that trusted a string

OX classifies this as CWE-807: reliance on untrusted inputs in a security decision. CVSS 9.4, vector published in their post. Affected: DeepSeek Harness 0.1.1-rc.2 and earlier.

The mechanism, at the level you need, is this. Harness gated its local API with a function OX names isTrustedApiRequest. That function read the Host header and treated the request as trusted if the value looked like loopback or sat on a configured trusted-hosts list. It did not check the actual peer address on the connection. A header is a string an agent can influence. A peer address is where the socket came from. Those are not the same fact.

The Hacker News summary of OX’s work is the part that should change how you read agent “approval” UX. Ordinary commands did not need approval. Approval fired when a command asked for more access than the session already had. The failing path did not ask for more access. It changed the session’s own mode to something OX and THN both name as danger-full-access, which turns the sandbox off and stops the prompts. From the tool’s point of view the session was now allowed. From yours, the box had been quietly widened.

OX checked that the sandbox had been doing its job first. Two sessions, same default settings, same follow-up command. The session that had flipped the mode wrote outside the workspace. The other was blocked. THN notes the sandbox is files. Command-line reference for the affected release said default writes were confined. Network and process policy are a different conversation, and OX’s point is you never get to that conversation if the file gate can be switched off from inside.

Trigger condition, again without the recipe: the agent had to read attacker-supplied text that told it to make the local call. That is prompt injection plus a confused deputy, not a remote worm. Someone still has to get text into the session. In a coding agent, “someone” is a README, a ticket, a file in the repo, a webpage you asked it to open. That bar is on the floor.

Timeline, and why the CVE dropped in September

OX’s own ledger:

• 24 August 2026: confirmed, disclosed to VulnCheck as CNA
• 27 August: fix in 0.1.2-alpha.1
• 30 August: OX re-tested the fix
• 8 September: CVE published

DevOps.com repeats the same dates and the same advice: upgrade. Three days from confirm to patch is fast for a project that had just become famous. Two weeks from patch to public CVE is normal coordinated disclosure. The uncomfortable interval is the days between “215,000 stars” and “please pull 0.1.2-alpha.1.” Viral clone now, security process later.

Default install, no extra network exposure, no extra credentials. OX is explicit. Localhost is not a security boundary if the agent is already on localhost and you have taught it to speak HTTP to itself.

What this is not

It is not proof that DeepSeek’s models are uniquely unsafe. It is proof that a harness with a plugin slogan and a Host-header allowlist will lose to the first agent that can emit a request. You could build the same hole in a weekend in any language. The star count is what turned a weekend hole into a CVE people will still search in 2027.

It is not a reason to ban local agents. Cloud agents have a different blast radius: they already have a token to your repo host. Local agents have your file system. Pick the failure you can survive, then patch.

It is not an exploit guide. If your response to a 9.4 is to go hunting for the command, you are the reason these posts get written in the first person plural.

What to actually do

Upgrade Harness to 0.1.2-alpha.1 or later. If you cannot name the version on the box, you are on the affected list until proven otherwise. Do not keep a copy of 0.1.1-rc.2 around because a tutorial from August pinned it.

Treat every agent session as hostile to its own host, including the ones you started. Untrusted text is the working directory, the issue tracker, and the web. If the product has a “danger” mode, it should require a human at a physical prompt, not a setting the session can write.

If you already refuse to hand agents the Docker socket, keep that rule. A sandbox that the model can disable is the same class of mistake as a socket that the model can reach. Different vendor, same wishful thinking.

The rest is product taste. Plugin architectures are catnip for people who want an ecosystem in month one. They are also a long list of ways to make a security decision on a string. “Everything is a Plugin” is a fine slogan for a text editor. It is a warning label on a process that runs shell.

If a vendor demo still needs danger-full-access to finish a sample, skip the demo. The sample is lying about the default you will actually run.

Document the version in the same ticket as the CVE number. Future you will not remember what 0.1.1-rc.2 was.

If your install path was “curl a script, run dsh, star the repo,” do the upgrade before the next coding session. Do not wait for a scanner that does not know what Harness is. The product is too new for half the SBOMs to have a row.

Do not paste a “danger mode” flag into a team wiki as a productivity tip. That wiki will be in the next agent’s context window. Write the upgrade ticket instead.

Upgrade in the same motion you would rotate a leaked token. If Harness is on a shared workstation, assume every session since August 2026 touched whatever that laptop could write. You do not need a forensic novel. You need a version number and a decision.

Localhost APIs are catnip for agent authors because the browser UI and the tool runner can share a port without exposing the LAN. 127.0.0.1:3080 sounds like “only I can touch this.” That is true for a human with a browser. It is false for a process you invited to run shell on the same box. The agent is already inside the house. Asking it to present a Host header that looks like loopback is asking it to knock with a name tag it printed itself.

CWE-807 is an old number. It means you let the caller tell you they are allowed. Cookies, headers, X-Forwarded-For, trustedHosts lists stuffed with localhost. Every decade rediscovers it. Agents make it worse because the caller is a text generator whose job is to be helpful when a README says “for convenience, disable the sandbox.” Helpful is the vulnerability class.

Plugin architectures multiply the same decision. If everything is a plugin, then every plugin is a chance to register a new “trusted” path. OX’s tagline quote, “Everything is a Plugin,” is not an insult. It is the reason a Host-header check was doing work a peer-address check should have done. You cannot audit 215,000-star velocity with a denylist of functions.

Compare this, briefly, to cloud coding agents. Those fail by leaking the token to GitHub or by following a poisoned issue. Harness failed by letting the session rewrite its own policy. Different blast radius, same lesson: the model must not be in the path that decides whether the model is still restricted. A human has to flip that bit, on a prompt that does not come from the model’s output buffer.

If you maintain an internal fork of 0.1.1-rc.2 because you patched something else, merge 0.1.2-alpha.1 or replay the trust check onto the socket. If you cannot tell whether isTrustedApiRequest still exists in your tree, you are not maintaining a fork. You are running a souvenir.

The disclosure itself is the grown-up part of this week. OX went to a CNA, DeepSeek shipped in three days, the CVE waited until the fix was real. That is how this is supposed to look. The star count is how it actually looked to people who installed on day three and went on holiday.

CVE-2026-82533 will get a one-line mention in the next round of “state of agent security” slide decks. The part worth keeping is smaller. The model did not break out with a novel trick. The harness asked the model whether the model should still be locked in, and then believed the header.