DeepSeek Harness let a confined agent disable its own sandbox through the local control plane

Reconstruction

DeepSeek Harness placed agent-executed commands inside an OS sandbox, but the sandbox boundary did not include the local control plane. OX Research found that confined processes could still reach loopback networking while ordinary shell calls required no approval. The harness's local HTTP API then decided whether a request was trusted from the client-supplied Host header rather than the actual connection peer.

That combination created a self-modifying authority path. An attacker-influenced command executed inside the confined session could contact the harness API on loopback, present a trusted-looking Host value, change the session preset to danger-full-access and set approval to never. OX reported a matched control on the same host: an out-of-workspace write was blocked before the permission change and succeeded after it.

The same API also had a separate remote exposure consequence. If an operator made the local port reachable through a tunnel, SSH/editor forwarding or reverse proxy, an unauthenticated remote caller could create sessions, execute commands and retrieve stored conversations. The vendor fix changed the browser/API trust design and OX reported a successful retest of 0.1.2-alpha.1.

Mechanism & boundary

1. 01

   Untrusted text influences an ordinary shell action

   For the local escape path, the precondition is that the agent executes a command induced by attacker-controlled input; ordinary shell calls did not require a separate approval.

   Boundary: untrusted content / agent tool execution

2. 02

   The confined process retains loopback reachability

   The OS sandbox constrained filesystem writes but did not isolate networking from the host, leaving the local harness API reachable.

   Boundary: sandbox / host-local network

3. 03

   The control plane trusts request metadata

   The local API accepts a loopback-looking Host value without binding that trust decision to the real TCP peer.

   Boundary: request metadata / privileged agent API

4. 04

   The session rewrites its own authority

   The confined caller changes the session to danger-full-access and disables approval, removing the control intended to contain later commands.

   Boundary: control plane / permission state

5. 05

   Subsequent actions run outside the intended confinement

   Local exploitation yields unconfined command execution. If the API port is externally reachable, the same trust flaw also permits remote session control and conversation retrieval.

   Boundary: agent permission state / host and stored data

Timeline

1. Aug 24, 2026

   OX confirms the vulnerability and discloses it through VulnCheck

   report

   OX states that execution confirmed the flaw and the report was submitted to VulnCheck as CNA.

2. Aug 27, 2026

   DeepSeek releases the fix

   mitigation

   DeepSeek Harness 0.1.2-alpha.1 is identified by OX and VulnCheck as the first fixed version.

3. Aug 30, 2026

   OX retests the fixed release

   verification

   OX reports re-testing 0.1.2-alpha.1 and confirming remediation.

4. Sep 8, 2026

   CVE-2026-82533 is published

   publication

   OX publishes its technical disclosure and VulnCheck publishes the CNA advisory.

Claims & evidence

Implications

An agent sandbox can be technically intact at the filesystem layer while the system as a whole is not confined. Any host-local service able to change agent permissions belongs inside the security boundary. Locality, Host headers and browser-origin assumptions are routing signals, not authentication, when confined workloads can originate their own requests.

Controls & mitigations

• Upgrade DeepSeek Harness to 0.1.2-alpha.1 or later.
• Authenticate privileged agent-control mutations independently of Host, Origin or loopback naming.
• Bind local control planes narrowly and require independent identity before any intentional remote exposure through forwarding, tunnels or proxies.
• Treat sandbox network reachability as part of the confinement model; prevent confined workloads from reaching host control planes they are intended to obey where feasible.
• Make permission-preset changes and approval disablement attributable to a distinct authenticated actor rather than to request metadata alone.
• Audit unexpected permission-preset changes or approval disablement in sessions that processed untrusted material.

What remains unknown

• The reviewed sources do not establish malicious exploitation in the wild.
• The number of affected installations that exposed the local control port is not established.
• The proof of concept demonstrates an induced escape path; it does not establish autonomous malicious intent by the model.
• No deployment-level telemetry in the scoped record shows whether attempted exploitation occurred before operators upgraded.

Connected research