PT-2026-87187 · Deepseek · Deepseek Harness
CVSS v3.1
9.6
Critical
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
🚨 AI AGENTS IN DEEPSEEK HARNESS CAN DISABLE THEIR OWN SANDBOX 🚨
CVE-2026-82533, CVSS 9.4, DeepSeek Harness (dsh).
215,000+ GitHub stars, fastest growing repo.
One. curl. command. = sandbox escape. 🤯
The harness ships an OS sandbox so a coding agent working on untrusted material can't reach your machine.
DeepSeek did everything right, they just forgot that the agent inside sandbox can communicate with the host machine via localhost, oh, and they also forgot that you can tell the localhost to... DISABLE THE SANDBOX 🤦
And it's not just that it escaped, the logs show that the commands the agents send - are logged as the user itself, "source": {"kind": "user"} - meaning that the harness couldn't tell its own agent's shell from a real user that's typing them.
Our team disclosed the vulnerability on Aug 24, and the issue was fixed on Aug 27 on 0.1.2-alpha.1.
Recommended Actions:
- Upgrade to 0.1.2-alpha.1 or later
Read the full blog:
https://t.co/s59GHrQo0J
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Deepseek Harness