Full Report
A flaw in DeepSeek Harness, DeepSeek's open-source tool for running AI coding agents on a developer's machine, let a sandboxed agent turn off its own sandbox with a single command. The tool runs an agent's commands inside an operating-system sandbox, so that an agent working on untrusted files cannot write outside its workspace. The agent could remove that limit by calling the tool's own web
Analysis Summary
# Vulnerability: DeepSeek Harness AI Agent Sandbox Escape
## CVE Details
- **CVE ID:** CVE-2026-82533
- **CVSS Score:** 9.4 (Critical)
- **CWE:** Host Header Spoofing / Missing Authentication (Likely CWE-288 or CWE-290)
## Affected Systems
- **Products:** DeepSeek Harness (Open-source AI coding agent tool)
- **Versions:** 0.1.1-rc.2 and all earlier versions.
- **Configurations:** Default installations where the agent is running and has access to its own local web interface.
## Vulnerability Description
DeepSeek Harness uses an operating-system sandbox to confine AI agents, preventing them from writing outside their workspace. However, the tool's own web interface, which controls session settings, remained reachable from inside the sandbox because network access was not restricted.
The interface lacked proper authentication and relied solely on checking the "Host" header to verify if a request was local. Because this header can be spoofed, an agent (prompted by malicious input) or an external attacker (via port forwarding/tunnels) could send a command to the interface. By invoking the `danger-full-access` mode, the agent could programmatically disable its own sandbox and suppress approval prompts, gaining unrestricted write access to the host file system.
## Exploitation
- **Status:** PoC available (demonstrated by OX Research).
- **Complexity:** Low (A single shell command is sufficient).
- **Attack Vector:** Local (or Network if the port is exposed via tunnels/SSH forwarding). The attack requires the agent to process attacker-supplied text (Indirect Prompt Injection).
## Impact
- **Confidentiality:** High (Callers can retrieve all stored conversation logs without a key).
- **Integrity:** High (Agents can write to or modify files anywhere on the developer's machine).
- **Availability:** High (Potential for system-wide file deletion or modification).
## Remediation
### Patches
Update to the following versions or later:
- **GitHub-based installations:** Version 0.1.2-alpha.1 or later.
- **NPM-based installations:** Version 0.1.2-alpha.2 or **0.1.2-rc.1** (Current recommended release).
### Workarounds
- Disable the web interface when not actively in use.
- Remove any active tunnels, proxies, or SSH port forwards reaching the tool's port.
- Avoid having the agent process untrusted files or prompts if an upgrade is not possible.
## Detection
- **Indicators of Compromise:**
- Presence of `danger-full-access` mode in session logs.
- Unexpected file writes outside the designated workspace directories.
- Web server logs showing requests to the session interface originating from unexpected sources or containing spoofed Host headers.
- **Detection Methods:** Audit agent activity logs for commands interacting with `localhost` or internal API endpoints.
## References
- **VulnCheck Advisory:** hxxps[://]www[.]vulncheck[.]com/advisories/deepseek-harness-alpha-1-authentication-bypass-via-host-header-spoofing
- **OX Research Blog:** hxxps[://]www[.]ox[.]security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/
- **DeepSeek Harness Repository:** hxxps[://]github[.]com/deepseek-ai/deepseek-harness