DeepSeek Harness Sandbox: CVE-2026-82533 Bypassed Sandbox Restrictions

The CVE-2026-82533 vulnerability in DeepSeek Harness allowed an AI coding agent to remove its own DeepSeek Harness sandbox restrictions. Researchers at OX Research rated the flaw CVSS 9.4. According to their analysis, an agent running in the sandbox could use the tool’s local HTTP interface to switch the session to “danger-full-access” mode and disable command approval without prompting the user.

DeepSeek Harness is a local tool for AI coding agents. Such agents may work with shells, source code and, in some cases, development credentials. The flaw therefore undermined the security boundary intended to limit the consequences of malicious instructions in files or prompt injection.

DeepSeek Harness sandbox and the problem of trusting the local API

According to OX Research, the cause was not a flaw in the file sandbox itself, but the way Harness evaluated requests to its local API. The interface determined client trust based on the HTTP Host header, which can be controlled by the client sending the request. It did not verify the actual origin of the connection.

An agent running in a restricted environment could therefore call the host tool’s control interface and change the security settings of its own session. OX states that the flaw worked in the standard configuration. In a scenario involving an untrusted repository or file, embedded instructions could persuade the agent to perform this step and then operate with the user’s account privileges.

The researchers also warn that a file sandbox alone is insufficient if it can reach an unauthenticated control interface of the host application. In this case, the restricted agent gained access to the mechanism that was supposed to determine whether the restrictions remained enabled.

The fix is available in newer Harness releases

OX Research said it retested the fix in version 0.1.2-alpha.1. The Hacker News, however, reports that the first fixed release published in the npm registry was version 0.1.2-alpha.2. According to this source, the current release, 0.1.2-rc.1, contains the fix.

DeepSeek Harness users should verify the version of the package they actually use, including any desktop or other third-party distributions. The key question is whether that distribution already includes a fixed release. When working with untrusted repositories, inputs or automated agent tasks, it is advisable not to assume that the sandbox provides complete isolation.

DeepSeek itself describes Harness in its SAFETY.md file as experimental software without a security audit. It also explicitly warns that the sandbox and approval mechanisms do not guarantee isolation and should not be the only layer of protection for untrusted tasks.

No confirmed exploitation against users

There are no confirmed cases of CVE-2026-82533 being exploited against users beyond research proof-of-concept demonstrations. As of September 9, 2026, DeepSeek had not published a separate security notice or advisory for this flaw.

Remote exploitation is not automatic. It would depend on whether the user exposed the local port, for example through a tunnel, proxy or port forwarding. Further developments will show whether DeepSeek issues an advisory, clarifies the scope of affected versions, or whether evidence emerges of exploitation or additional sandbox bypasses after the fix.

Verified and updated: 09/09/2026 15:29