A critical vulnerability in DeepSeek Harness, DeepSeek's open-source tool for running AI coding agents locally, allowed a sandboxed agent to disable its own confinement with a single shell command on shipped default settings1,2.
OX Research discovered and disclosed the flaw, tracked as CVE-2026-82533, which carries a CVSS score of 9.4. The vulnerability required no network exposure, no credentials, and no deviation from defaults.
DeepSeek Harness presents a browser UI backed by a local HTTP API on 127.0.0.1:3080. The tool runs an agent's commands inside an operating-system sandbox designed to prevent an agent working on untrusted files from writing outside its workspace. The root cause: DeepSeek Harness exposed its agent-control API on a local HTTP port without authentication, relying solely on the client-supplied Host request header to determine whether a request was trusted rather than verifying the connection's actual peer address. The vulnerability is classified under CWE-807, "Reliance on Untrusted Inputs in a Security Decision".
Because the product's OS sandbox restricted file writes but left loopback networking open, a sandboxed agent could call that API and elevate its own session to full access with approval prompts disabled. If the port was exposed to a network, the same unauthenticated interface also allowed a remote attacker to take full control of the agent and export every stored conversation without a key.
DeepSeek Harness 0.1.1-rc.2 and earlier versions are affected. The issue was remediated in DeepSeek Harness 0.1.2-alpha.1. The research was published on September 8, 2026, by OX Research's Nir Zadok and Moshe Siman Tov Bustan.
DeepSeek Harness was released in August 2026 and reached more than 215,000 GitHub stars within weeks. ANALYSIS The rapid adoption rate means a large developer population was running the vulnerable default configuration during the window between the tool's August 2026 release and the patched 0.1.2-alpha.1 build.
The flaw is architecturally distinct from typical sandbox escapes: rather than exploiting a kernel bug or a container misconfiguration, the agent used the harness's own control plane against itself, turning an internal API into a privilege-escalation vector. The design choice to trust the Host header on a loopback socket, combined with leaving loopback networking open inside the sandbox, created a path that required no external tooling to exploit.
DeepSeek has been active on multiple fronts this month. The company began a limited-time beta of its V4.1 Flash multimodal model on September 9, scheduled to go offline on September 10[1]. Separately, DeepSeek has ordered more than 160,000 Huawei Technologies Ascend 950DT accelerators for a data center under construction in Inner Mongolia[3].
Users running DeepSeek Harness 0.1.1-rc.2 or earlier should upgrade to DeepSeek Harness 0.1.2-alpha.1 or later.