The report
DeepSeek's superagent prototype documents a persistent workflow: incoming requests and approved automation rules produce Tickets, which in turn receive Executor Sessions with their own working directories. The documentation states that worker sessions run shell commands without per-command approval as the operating-system user running the system. Foreground commands can continue as background jobs, and workers may retain slots while those jobs or subagents remain active. Review the execution design.
This creates two distinct authorization decisions. Admission determines whether a task is allowed into the queue; execution determines what a continuing worker can actually do after admission. A revoked or edited automation rule cannot be assumed to retract authority from an already-running shell process unless the runtime enforces that transition. The Case dossier treats this as a design evaluation rather than labeling a published prototype a compromised system.
Why a long-lived mandate needs a separate enforcement boundary
A Ticket can be useful for work that outlasts a single conversation turn. But separating work into sessions and directories does not automatically isolate privileges, network destinations or secrets. The relevant questions are which OS user executes commands, which tools the session retains, how policies change for existing sessions and whether completed side effects have independent receipts. A waiting or running state is not proof that a task has been performed correctly.
No public exploit or production failure is established by the cited documentation. It provides a concrete architecture against which to test future autonomous agent systems, particularly revocation, execution scopes and durable recovery.