{"id":5039,"date":"2026-09-09T16:13:57","date_gmt":"2026-09-09T16:13:57","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/09\/09\/flaw-in-deepseek-harness-ai-coding-tool-let-agents-disable-their-sandbox\/"},"modified":"2026-09-09T16:13:57","modified_gmt":"2026-09-09T16:13:57","slug":"flaw-in-deepseek-harness-ai-coding-tool-let-agents-disable-their-sandbox","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/09\/09\/flaw-in-deepseek-harness-ai-coding-tool-let-agents-disable-their-sandbox\/","title":{"rendered":"Flaw in DeepSeek Harness AI Coding Tool Let Agents Disable Their Sandbox"},"content":{"rendered":"
\"\"<\/div>\n

\"\"<\/p>\n

Amid ongoing reports of AI agents breaking free of their isolated environments and wreaking havoc, comes news that a recently fixed vulnerability in DeepSeek Harness, the Chinese company\u2019s popular open-source AI coding tool, allowed agents to disable its own sandbox and escape its restrictions.<\/p>\n

The critical vulnerability \u2013 tracked as CVE-2026-82533<\/a> and given a CVSS severity score of 9.4 out of 10 \u2013 not only posed a threat by allowing an AI agent to bypass its sandbox restrictions, but also could let an unauthenticated remote attacker to gain direct control of the agent and download whatever conversations were stored, all without an API key or model call, according to OX Security researchers Nir Zadok and Moshe Siman Tov Bustan.<\/p>\n

\u201cThat meant a single command was enough,\u201d Zadok and Bustan wrote in a report<\/a> this week. \u201cFrom inside the sandbox, the agent could call the harness\u2019s own unauthenticated API and elevate its session to \u2018danger-full-access\u2019 with approval set to \u2018never\u2019. Every command after that ran unconfined and without prompting.\u201d<\/p>\n

OpenAI, Anthropic<\/a>, and Meta<\/a> are among the AI companies that have reported over the past few months that agents that were thought to be confined in internet-isolated sandboxes during testing were able to escape and breach third-party infrastructures as they worked to complete the tasks they were given. In some cases, the agents were able to create unauthorized message boards and collaborate.<\/p>\n

The incidents raised concerns about how much control such AI companies actually have over the technology they\u2019re creating and how the advancements in AI are rapidly outpacing the security controls<\/a> being developed around it.<\/p>\n

Coding Harness a \u2018High-Value Target\u2019<\/h3>\n

According to OX Security, DeepSeek released DeepSeek Harness \u2013 used for running AI coding agents \u2013 last month. It was quickly embraced by developers, reaching more than 215,000 GitHub stars<\/a> in a matter of weeks, which the researchers said made it among the most widely starred developer tools this year.<\/p>\n

Zadok and Bustan described it as a \u201clocal-first\u201d harness that includes a browser UI with a local HTTP API and is built on a plugin architecture.<\/p>\n

\u201cA coding-agent harness is a high-value target for the same reason it is useful: it holds a shell,\u201d they wrote. \u201cThe agent reads and writes source trees, runs build and test commands, and operates with the ambient authority of the developer who launched it \u2013 potentially including access to SSH keys, cloud credentials, package registries, and internal systems reachable from that workstation.\u201d<\/p>\n

In a proof-of-concept (PoC), the researchers used a default installation and confirmed the sandbox was enforcing its restrictions before the escape by the agents. They also showed a second attack path, finding that wherever the port was reachable \u2013 which could include a tunnel, reverse proxy, SSH forward, editor port forward, or other similar ways \u2013 an unauthenticated remote attacker could gain control of the agent.<\/p>\n

Disabling the Sandbox<\/h3>\n

DeepSeek Harness includes an OS sandbox for agents that are working with material they shouldn\u2019t trust, they wrote. However, the security flaw discovered by OX lets the agent disable the sandbox, which removes the control that is used to keep the untrusted input and developer\u2019s machine separate.<\/p>\n

OX\u2019s researchers \u201ctraced the vulnerability to the way DeepSeek Harness gated access to its local API,\u201d Zadok and Bustan wrote. \u201cA single function, \u2018isTrustedApiRequest\u2019, read the \u2018Host\u2019 request header and allowed access if the value was a loopback authority or appeared in a configured \u2018trustedHosts\u2019 list. Crucially, it never compared that value with the connection\u2019s actual peer address.\u201d<\/p>\n

The single function was designed to ensure that a DNS-binding request that used an attacker\u2019s domain would be rejected. The problem, they wrote, the host request header was the only input function used. A system that wasn\u2019t tied to the browser restrictions could supply its own trusted host value.<\/p>\n

A \u2018Fence\u2019 With Holes<\/h3>\n

In their PoC, the researchers used two requests that were identical in every aspect, except within the \u201chost\u201d header. They found that the \u201cfence\u201d that protected the environment against a foreign host couldn\u2019t tell the difference between a legitimate loopback request and that from a client that only claimed to be a loopback.<\/p>\n

In its description of the bypass vulnerability<\/a>, VulnCheck notes that the local HTTP control-plane API lets attackers gain full control of an agent via the spoofed Host header because the server only validates the client-supplied Host header value and not the origin of the TCP connection. Through this, threat actors can invoke privileged commands, escalate session approval policies to execution outside of confinements, and grab all stored conversations.<\/p>\n

Ox Security confirmed the vulnerability in DeepSeek Harness on August 24 by running the PoC and disclosed it to VulnCheck the same day. Three days later, DeepSeek released DeepSeek Harness 0.1.2-alpha.1, which fixed the vulnerability, which Ox confirmed through tests on August 30. The researchers recommend that developers upgrade to the fixed version.<\/p>\n

Read More<\/a><\/p>\n

\u200b<\/p>","protected":false},"excerpt":{"rendered":"

Amid ongoing reports of AI agents breaking free of their isolated environments and wreaking havoc, comes news that a recently […]<\/p>\n","protected":false},"author":1,"featured_media":5040,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-5039","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5039","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=5039"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5039\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/5040"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=5039"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=5039"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=5039"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}