Amid ongoing reports of AI agents breaking free of their isolated environments and wreaking havoc, comes news that a recently fixed vulnerability in DeepSeek Harness, the Chinese company’s popular open-source AI coding tool, allowed agents to disable its own sandbox and escape its restrictions.
The critical vulnerability – tracked as CVE-2026-82533 and given a CVSS severity score of 9.4 out of 10 – not only posed a threat by allowing an AI agent to bypass its sandbox restrictions, but also could let an unauthenticated remote attacker to gain direct control of the agent and download whatever conversations were stored, all without an API key or model call, according to OX Security researchers Nir Zadok and Moshe Siman Tov Bustan.
“That meant a single command was enough,” Zadok and Bustan wrote in a report this week. “From inside the sandbox, the agent could call the harness’s own unauthenticated API and elevate its session to ‘danger-full-access’ with approval set to ‘never’. Every command after that ran unconfined and without prompting.”
OpenAI, Anthropic, and Meta are among the AI companies that have reported over the past few months that agents that were thought to be confined in internet-isolated sandboxes during testing were able to escape and breach third-party infrastructures as they worked to complete the tasks they were given. In some cases, the agents were able to create unauthorized message boards and collaborate.
The incidents raised concerns about how much control such AI companies actually have over the technology they’re creating and how the advancements in AI are rapidly outpacing the security controls being developed around it.
Coding Harness a ‘High-Value Target’
According to OX Security, DeepSeek released DeepSeek Harness – used for running AI coding agents – last month. It was quickly embraced by developers, reaching more than 215,000 GitHub stars in a matter of weeks, which the researchers said made it among the most widely starred developer tools this year.
Zadok and Bustan described it as a “local-first” harness that includes a browser UI with a local HTTP API and is built on a plugin architecture.
“A coding-agent harness is a high-value target for the same reason it is useful: it holds a shell,” they wrote. “The agent reads and writes source trees, runs build and test commands, and operates with the ambient authority of the developer who launched it – potentially including access to SSH keys, cloud credentials, package registries, and internal systems reachable from that workstation.”
In a proof-of-concept (PoC), the researchers used a default installation and confirmed the sandbox was enforcing its restrictions before the escape by the agents. They also showed a second attack path, finding that wherever the port was reachable – which could include a tunnel, reverse proxy, SSH forward, editor port forward, or other similar ways – an unauthenticated remote attacker could gain control of the agent.
Disabling the Sandbox
DeepSeek Harness includes an OS sandbox for agents that are working with material they shouldn’t trust, they wrote. However, the security flaw discovered by OX lets the agent disable the sandbox, which removes the control that is used to keep the untrusted input and developer’s machine separate.
OX’s researchers “traced the vulnerability to the way DeepSeek Harness gated access to its local API,” Zadok and Bustan wrote. “A single function, ‘isTrustedApiRequest’, read the ‘Host’ request header and allowed access if the value was a loopback authority or appeared in a configured ‘trustedHosts’ list. Crucially, it never compared that value with the connection’s actual peer address.”
The single function was designed to ensure that a DNS-binding request that used an attacker’s domain would be rejected. The problem, they wrote, the host request header was the only input function used. A system that wasn’t tied to the browser restrictions could supply its own trusted host value.
A ‘Fence’ With Holes
In their PoC, the researchers used two requests that were identical in every aspect, except within the “host” header. They found that the “fence” that protected the environment against a foreign host couldn’t tell the difference between a legitimate loopback request and that from a client that only claimed to be a loopback.
In its description of the bypass vulnerability, VulnCheck notes that the local HTTP control-plane API lets attackers gain full control of an agent via the spoofed Host header because the server only validates the client-supplied Host header value and not the origin of the TCP connection. Through this, threat actors can invoke privileged commands, escalate session approval policies to execution outside of confinements, and grab all stored conversations.
Ox Security confirmed the vulnerability in DeepSeek Harness on August 24 by running the PoC and disclosed it to VulnCheck the same day. Three days later, DeepSeek released DeepSeek Harness 0.1.2-alpha.1, which fixed the vulnerability, which Ox confirmed through tests on August 30. The researchers recommend that developers upgrade to the fixed version.
