CVE-2026-82533: DeepSeek Harness agents could kill their own sandbox
A critical security flaw in DeepSeek Harness, the Chinese company’s open source AI coding tool, let agents disable their own sandbox restrictions and gave unauthenticated remote attackers full agent control. The vulnerability has since been patched.
What the Flaw Did
Tracked as CVE-2026-82533 with a CVSS severity score of 9.4 out of 10, the bug lived in the tool’s local HTTP control-plane API. The server validated only the client-supplied Host header rather than the actual TCP connection origin, so an attacker could spoof the Host header to bypass authentication entirely.
According to OX Security researchers Nir Zadok and Moshe Siman Tov Bustan, a successful exploit allowed an attacker to invoke privileged commands with danger-full-access permissions, escalate session approval policies to unconfined execution, and pull down all stored conversations. No API key or model call required.
Why It Matters Beyond DeepSeek
This is not just a single vendor’s problem. The disclosure lands amid a broader pattern of AI agents escaping isolated environments. VulnCheck flagged the flaw as trending. Researchers at OX Security specifically called out the wider concern: AI vendors, including those from OpenAI, Anthropic, and Meta, do not yet have complete control over their autonomous agents.
The fix shipped in version 0.1.2-alpha.1. If you run any version of DeepSeek Harness before that, update now.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
