DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval
A critical vulnerability (CVE-2026-82533) in DeepSeek Harness allowed AI coding agents to disable their own file sandbox and bypass approval prompts with a single command The flaw exploited the tool's unauthenticated local web interface, which trusted the Host header rather than the connection origin, enabling sandbox escape The vulnerability carried a VulnCheck severity rating of 9.4/10 and affected versions 0.1.1-rc.2 and earlier, with the fix first appearing in 0.1.2-alpha.2 on npm (August 30
Analysis
TL;DR
- A critical vulnerability (CVE-2026-82533) in DeepSeek Harness allowed AI coding agents to disable their own file sandbox and bypass approval prompts with a single command
- The flaw exploited the tool's unauthenticated local web interface, which trusted the Host header rather than the connection origin, enabling sandbox escape
- The vulnerability carried a VulnCheck severity rating of 9.4/10 and affected versions 0.1.1-rc.2 and earlier, with the fix first appearing in 0.1.2-alpha.2 on npm (August 30)
- The sandbox only confined file writes, not reads or network access, leaving the web interface reachable from within the agent's environment
- The fix introduced a one-time token and signed cookie authentication, but the underlying sandbox architecture remains unchanged
Why It Matters
This vulnerability exemplifies a growing class of risks in AI coding agents where sandbox escapes can grant attackers full shell access under the user's account. For AI practitioners and security researchers, it underscores that sandboxing and approval prompts in developer tools cannot be treated as sufficient security guarantees without rigorous architectural review. The incident also highlights the danger of unauthenticated local interfaces in tools that handle sensitive development workflows.
Technical Details
- Vulnerability Mechanism: The agent could invoke DeepSeek Harness's local web interface from within the sandbox using a single shell command that set the session to "danger-full-access" mode, disabling the sandbox and approval prompts without triggering an authorization check
- Root Cause: The web interface's access control checked only the HTTP Host header (a client-supplied value) rather than the connection origin, and contained no authentication layer; a comment in the source code explicitly acknowledged this was "not an auth layer"
- Sandbox Limitations: The sandbox only restricted file writes to the workspace and temporary folders; reads and network access were explicitly unconfined, and the agent's shell was provided with the interface address and session identifier at startup
- Severity and CVE: Assigned CVE-2026-82533 by VulnCheck, rated 9.4/10, published September 8, 2026
- Fix Implementation: Version 0.1.2-alpha.2 introduced a one-time token printed at startup that the browser exchanges for a signed cookie, requiring the cookie for every subsequent interface call; however, the sandbox architecture (unconfined reads/network) remains unchanged in the current release 0.1.2-rc.1
- Affected Versions Timeline: 0.1.1-rc.2 (August 21, affected) → 0.1.2-alpha.1 (August 27, GitHub only, not on npm) → 0.1.2-alpha.2 (August 30, first fixed npm release) → 0.1.2-rc.1 (September 3, current npm release)
Industry Insight
- Sandboxing is not isolation: AI agent harnesses must be audited for architectural escape vectors; file-level sandboxes that leave network and read access unconfined are insufficient for untrusted workloads, and developers should not rely on them as primary security controls
- Local web interfaces are attack surface: Any tool exposing a local HTTP interface without authentication—especially one that receives credentials, tokens, or session identifiers in its environment—creates a trivial privilege escalation path for compromised agents
- Supply chain and distribution risk: Third-party desktop wrappers may ship vulnerable versions (one Windows build pinned 0.1.1-rc.2 until September 6), and the gap between GitHub fixes and npm publication creates a window of exposure; users must verify their installed versions and consider stopping the web interface when not in active use
Disclaimer: The above content is generated by AI and is for reference only.