Article

DeepSeek Harness — CVE-2026-82533 sandbox escape

This was not a novel agent soul. It was a control plane that trusted a forgeable Host header, an OS sandbox that blocked file writes but left loopback networking open, and shipped defaults that let a confined coding agent turn its own session into danger-full-access with approval prompts set to never.

What happened

OX Security researched DeepSeek Harness (dsh) — DeepSeek’s open-source, local-first coding-agent harness (browser UI over a local HTTP API on 127.0.0.1:3080). Agent commands run under bubblewrap, Landlock, or Seatbelt depending on platform. On 24 August 2026, OX confirmed a critical escape by execution and disclosed to VulnCheck as CNA. Fix landed in 0.1.2-alpha.1 on 27 August; OX re-tested 30 August. Public write-up and CVE-2026-82533 (CVSS 9.4, CWE-807) arrived 8 September 2026. Affected: 0.1.1-rc.2 and earlier.

Mechanism (high level): isTrustedApiRequest allowed API access when the client-supplied Host looked like loopback or a configured trusted host — without checking the connection’s real peer address. That stops browser DNS-rebinding; it does not stop a non-browser client that simply claims to be loopback. Sandbox profiles denied many file writes but shared the host network namespace (no --unshare-net / Seatbelt still allowed networking). Ordinary bash tool calls needed no approval. From inside the sandbox, one shell call to the local control API elevated the session; the harness logged the policy change as if from a user. Matched controls showed the sandbox had been enforcing before the escape.

Second path: wherever the port is reachable (tunnel, reverse proxy, SSH/editor forward), an unauthenticated remote party can control the agent and export stored conversations without a key.

What was at stake: a coding harness holds a shell with the developer’s ambient authority — source trees, build/test, potentially SSH keys, cloud credentials, registries, and internal networks. The sandbox existed to bound untrusted-input work; disabling it removes that bound on defaults, without needing prior credentials or intentional misconfiguration.

Why it matters

Site thesis: safety as hard bounds, not stories about model intent. Here the bound was advisory against the threat that mattered (agent or local client forging trust). Host-header trust is a classical weak auth decision; open loopback inside a “sandbox” is a classical incomplete confinement. Together they turn the agent’s ordinary tool use into a self-service privilege escalation. Prefer impact: platform because dsh is an ecosystem developer tool at very large star count — blast is many workstations sharing one flawed default, not a single lab cluster. overprivileged_creds fits the trust-as-credential mistake (spoofable Host as admission); we hold novel_capability — classical vulns, agent-shaped trigger.

What this is NOT

Not evidence that DeepSeek foundation models uniquely invent escapes. Not a claimed mass exploitation campaign in the wild (OX demonstrates PoC on defaults). Not interchangeable with frontier-lab eval egress rows (HF×OpenAI, Mythos/PyPI): different party, local harness, no eval-reward story required. Not a reason to skip patching past 0.1.2-alpha.1.

Sources

• OX Security — CVE-2026-82533: DeepSeek Harness AI Agent Sandbox Escape