Nir Zadok

🚨 AI AGENTS IN DEEPSEEK HARNESS CAN DISABLE THEIR OWN SANDBOX 🚨 CVE-2026-82533, CVSS 9.4, DeepSeek Harness (dsh). 215,000+ GitHub stars, fastest growing repo. One. curl. command. = sandbox escape. 🤯 The harness ships an OS sandbox so a coding agent working on untrusted material can't reach your machine. DeepSeek did everything right, they just forgot that the agent inside sandbox can communicate with the host machine via localhost, oh, and they also forgot that you can tell the localhost to... DISABLE THE SANDBOX 🤦 And it's not just that it escaped, the logs show that the commands the agents send - are logged as the user itself, "source": {"kind": "user"} - meaning that the harness couldn't tell its own agent's shell from a real user that's typing them. Our team disclosed the vulnerability on Aug 24, and the issue was fixed on Aug 27 on 0.1.2-alpha.1. Recommended Actions: - Upgrade to 0.1.2-alpha.1 or later Read the full blog: https://t.co/s59GHrQo0J