DIGGINGBEAGLE

Case · DiggingBeagle record

DeepSeek Harness let a confined agent disable its own sandbox through the local control plane

CVE-2026-82533 affected DeepSeek Harness before 0.1.2-alpha.1. The local agent-control API trusted a client-supplied Host value, allowing a confined process to reach the loopback service and change its own permission state; exposed deployments also had an unauthenticated remote-control path.

Localhost is not a trust boundary for agentsAgent authority
Scope

Defensive vulnerability disclosure affecting DeepSeek Harness 0.1.1-rc.2 and earlier. OX reproduced the local sandbox escape on a default installation. The local path requires an attacker-influenced command to be executed by the agent's ordinary shell tool; the remote path requires the harness control port to be exposed through forwarding, a tunnel or a proxy. The reviewed sources do not establish malicious exploitation in the wild or autonomous malicious intent by the model.

UnratedAI role: AGAINST AIAssessment method

At a glance

Mechanism and trust boundary

  1. 01

    Untrusted text influences an ordinary shell action

    For the local escape path, the precondition is that the agent executes a command induced by attacker-controlled input; ordinary shell calls did not require a separate approval.

    Boundary: untrusted content / agent tool execution

  2. 02

    The confined process retains loopback reachability

    The OS sandbox constrained filesystem writes but did not isolate networking from the host, leaving the local harness API reachable.

    Boundary: sandbox / host-local network

  3. 03

    The control plane trusts request metadata

    The local API accepts a loopback-looking Host value without binding that trust decision to the real TCP peer.

    Boundary: request metadata / privileged agent API

  4. 04

    The session rewrites its own authority

    The confined caller changes the session to danger-full-access and disables approval, removing the control intended to contain later commands.

    Boundary: control plane / permission state

  5. 05

    Subsequent actions run outside the intended confinement

    Local exploitation yields unconfined command execution. If the API port is externally reachable, the same trust flaw also permits remote session control and conversation retrieval.

    Boundary: agent permission state / host and stored data

Timeline

  1. Aug 24, 2026
    Event type unspecified

    OX confirms the vulnerability and discloses it through VulnCheck

    OX states that execution confirmed the flaw and the report was submitted to VulnCheck as CNA.

  2. Aug 27, 2026
    mitigation

    DeepSeek releases the fix

    DeepSeek Harness 0.1.2-alpha.1 is identified by OX and VulnCheck as the first fixed version.

  3. Aug 30, 2026
    Event type unspecified

    OX retests the fixed release

    OX reports re-testing 0.1.2-alpha.1 and confirming remediation.

  4. Sep 8, 2026
    Event type unspecified

    CVE-2026-82533 is published

    OX publishes its technical disclosure and VulnCheck publishes the CNA advisory.

Claims & evidence

CLM-DEEPSEEK-82533-FIXThe vulnerability was fixed in DeepSeek Harness 0.1.2-alpha.1, and OX reports that it re-tested that release on August 30, 2026 and confirmed remediation.supported

Basis: reported finding

Link to claim
CLM-DEEPSEEK-82533-REMOTEWhen the local control port was made reachable through a tunnel, SSH forward or reverse proxy, the same flaw could allow an unauthenticated remote caller to create sessions, execute arbitrary commands and retrieve stored conversations.supported

Basis: reported finding

Link to claim
CLM-DEEPSEEK-82533-CONTROLOX reported a matched control in which the same out-of-workspace write was blocked in a confined session but succeeded after the otherwise identical session first removed its confinement.supported

Basis: reported finding

Link to claim
CLM-DEEPSEEK-82533-DEFAULTOX Research reports reproducing the local sandbox escape on the shipped default configuration without externally exposing the control port or supplying credentials.supported

Basis: reported finding

Link to claim
CLM-DEEPSEEK-82533-SEVERITYVulnCheck lists CVE-2026-82533 as CWE-807 and scores it 9.4 under CVSS v4.supported

Basis: reported finding

Scope: Severity measurement for the vulnerability; it does not measure deployment prevalence or exploitation frequency.

Recorded measurement: 9.4 CVSS v4 base score · VulnCheck CNA vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Link to claim
CLM-DEEPSEEK-82533-ATTRIBUTIONOX reported that the policy change was recorded as user-sourced and that no approval/request event appeared, so the harness could not distinguish the agent's shell-originated request from human operator action.supported

Basis: reported finding

Scope: This is an attribution/control-plane observation, not evidence that the model independently formed malicious intent.

Link to claim
CLM-DEEPSEEK-82533-LOCAL-ESCAPEDeepSeek Harness before 0.1.2-alpha.1 allowed a process confined by the harness sandbox to call the local agent-control API with a spoofed loopback Host value and switch the session to danger-full-access with approval disabled.supported

Basis: reported finding

Link to claim

Implications

An agent sandbox can be technically intact at the filesystem layer while the system as a whole is not confined. Any host-local service able to change agent permissions belongs inside the security boundary. Locality, Host headers and browser-origin assumptions are routing signals, not authentication, when confined workloads can originate their own requests.

Controls and mitigations

  • Upgrade DeepSeek Harness to 0.1.2-alpha.1 or later.
  • Authenticate privileged agent-control mutations independently of Host, Origin or loopback naming.
  • Bind local control planes narrowly and require independent identity before any intentional remote exposure through forwarding, tunnels or proxies.
  • Treat sandbox network reachability as part of the confinement model; prevent confined workloads from reaching host control planes they are intended to obey where feasible.
  • Make permission-preset changes and approval disablement attributable to a distinct authenticated actor rather than to request metadata alone.
  • Audit unexpected permission-preset changes or approval disablement in sessions that processed untrusted material.

Unknowns and contradictions

  • The reviewed sources do not establish malicious exploitation in the wild.
  • The number of affected installations that exposed the local control port is not established.
  • The proof of concept demonstrates an induced escape path; it does not establish autonomous malicious intent by the model.
  • No deployment-level telemetry in the scoped record shows whether attempted exploitation occurred before operators upgraded.

Sources and citation

EvidenceCVE-2026-82533: DeepSeek Harness AI Agent Sandbox EscapeEvidenceDeepSeek Harness fix: authenticate the browser Host APIEvidenceDeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing

Material revision history

  1. Sep 19, 2026 · Published version · first publication · revision 22
Record metadata

Canonical ID: CASE-2026-DEEPSEEK-HARNESS-CVE-82533 · revision 22

Legacy date (semantics unspecified): 2026-09-08. This value is not treated as an occurrence or disclosure date.