--- title: Flaw in DeepSeek Harness AI Coding Tool Let Agents... description: A critical vulnerability (CVE-2026-82533, CVSS 9.4) in DeepSeek's open-source AI coding tool, DeepSeek Harness, allowed AI agents to disable their own sandbox... canonical: https://daily.dev/posts/flaw-in-deepseek-harness-ai-coding-tool-let-agents-disable-their-sandbox-s4iyp9o5t twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Flaw in DeepSeek Harness AI Coding Tool Let Agents Disable Their Sandbox | daily.dev og:description: A critical vulnerability (CVE-2026-82533, CVSS 9.4) in DeepSeek's open-source AI coding tool, DeepSeek Harness, allowed AI agents to disable their own sandbox... og:url: https://daily.dev/posts/flaw-in-deepseek-harness-ai-coding-tool-let-agents-disable-their-sandbox-s4iyp9o5t og:image: https://api.daily.dev/og/posts/s4iyP9o5t.png og:image:alt: Flaw in DeepSeek Harness AI Coding Tool Let Agents Disable Their Sandbox og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Flaw in DeepSeek Harness AI Coding Tool Let Agents Disable Their Sandbox **[DevOps.com](https://daily.dev/sources/devops)** · 6 min read · 0 upvotes · 0 comments ## Summary A critical vulnerability (CVE-2026-82533, CVSS 9.4) in DeepSeek's open-source AI coding tool, DeepSeek Harness, allowed AI agents to disable their own sandbox restrictions. It also let unauthenticated remote attackers seize control of agents and steal stored conversations, without needing an API key or model call. OX Security researchers traced the flaw to a function that trusted a spoofable 'Host' header instead of verifying the actual connection origin, letting attackers fake a trusted loopback request. DeepSeek patched the issue in version 0.1.2-alpha.1, three days after disclosure. Researchers urge users to upgrade and audit whether their local API is exposed via tunnels, proxies, or port forwarding. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-82533 in DeepSeek Harness? CVE-2026-82533 is a critical vulnerability (CVSS 9.4) in DeepSeek Harness, an open-source AI coding tool, that let AI agents disable their own sandbox and escape restrictions. It also let unauthenticated remote attackers seize control of the agent and steal stored conversations without an API key, by exploiting a function called isTrustedApiRequest that trusted a spoofed Host header instead of verifying the real connection source. _Teams running AI coding agents locally should track sandbox-escape disclosures like this one on daily.dev before deploying similar tools._ ### How do I fix the DeepSeek Harness sandbox escape vulnerability? Upgrade to DeepSeek Harness version 0.1.2-alpha.1 or later, which patches the Host header spoofing flaw that allowed sandbox escapes and unauthenticated remote takeover. DeepSeek released the fix three days after OX Security disclosed the issue to VulnCheck on August 24, and OX confirmed the patch resolved the vulnerability by August 30. Also audit whether the local API port is exposed via tunnels, proxies, or SSH forwarding. _Anyone patching AI-agent tooling can follow security fixes like this through daily.dev to stay ahead of exposure._ ### How did attackers bypass the sandbox in DeepSeek Harness without an API key? Attackers exploited a flaw in the isTrustedApiRequest function, which read the client-supplied Host header and granted access if it matched a loopback authority or a trustedHosts entry, without checking the actual TCP connection's peer address. By spoofing the Host header, a remote attacker could trick the harness into treating the request as a trusted local connection, then escalate the session to full unconfined access. _Developers evaluating AI agent harness security can dig into exploit mechanics like this via daily.dev._ ## Similar posts on daily.dev - [Chinese Actor Weaponizes DeepSeek AI Agent Against Security Firm](https://daily.dev/posts/chinese-actor-weaponizes-deepseek-ai-agent-against-security-firm-htf1hk6en) · Dark Reading · 0 upvotes · 0 comments - [Hacker uses DeepSeek AI to autonomously attack vulnerable servers](https://daily.dev/posts/hacker-uses-deepseek-ai-to-autonomously-attack-vulnerable-servers-b4dqtodah) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/flaw-in-deepseek-harness-ai-coding-tool-let-agents-disable-their-sandbox-s4iyp9o5t) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Flaw in DeepSeek Harness AI Coding Tool Let Agents Disable Their Sandbox","url":"https://daily.dev/posts/flaw-in-deepseek-harness-ai-coding-tool-let-agents-disable-their-sandbox-s4iyp9o5t","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/flaw-in-deepseek-harness-ai-coding-tool-let-agents-disable-their-sandbox-s4iyp9o5t"},"datePublished":"2026-09-09T15:59:50.081Z","dateModified":"2026-10-15T02:22:48.801Z","description":"A critical vulnerability (CVE-2026-82533, CVSS 9.4) in DeepSeek's open-source AI coding tool, DeepSeek Harness, allowed AI agents to disable their own sandbox...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/33e9b3d3573aa295b65a61123305b152?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/33e9b3d3573aa295b65a61123305b152?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DevOps.com","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DevOps.com","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/db8f2265cff0416c878c6e7e92bb8715","url":"https://daily.dev/sources/devops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/flaw-in-deepseek-harness-ai-coding-tool-let-agents-disable-their-sandbox-s4iyp9o5t","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DevOps.com","item":"https://daily.dev/sources/devops"},{"@type":"ListItem","position":3,"name":"Flaw in DeepSeek Harness AI Coding Tool Let Agents Disable Their Sandbox"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/flaw-in-deepseek-harness-ai-coding-tool-let-agents-disable-their-sandbox-s4iyp9o5t#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-82533 in DeepSeek Harness?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-82533 is a critical vulnerability (CVSS 9.4) in DeepSeek Harness, an open-source AI coding tool, that let AI agents disable their own sandbox and escape restrictions. It also let unauthenticated remote attackers seize control of the agent and steal stored conversations without an API key, by exploiting a function called isTrustedApiRequest that trusted a spoofed Host header instead of verifying the real connection source. Teams running AI coding agents locally should track sandbox-escape disclosures like this one on daily.dev before deploying similar tools."}},{"@type":"Question","name":"How do I fix the DeepSeek Harness sandbox escape vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Upgrade to DeepSeek Harness version 0.1.2-alpha.1 or later, which patches the Host header spoofing flaw that allowed sandbox escapes and unauthenticated remote takeover. DeepSeek released the fix three days after OX Security disclosed the issue to VulnCheck on August 24, and OX confirmed the patch resolved the vulnerability by August 30. Also audit whether the local API port is exposed via tunnels, proxies, or SSH forwarding. Anyone patching AI-agent tooling can follow security fixes like this through daily.dev to stay ahead of exposure."}},{"@type":"Question","name":"How did attackers bypass the sandbox in DeepSeek Harness without an API key?","acceptedAnswer":{"@type":"Answer","text":"Attackers exploited a flaw in the isTrustedApiRequest function, which read the client-supplied Host header and granted access if it matched a loopback authority or a trustedHosts entry, without checking the actual TCP connection's peer address. By spoofing the Host header, a remote attacker could trick the harness into treating the request as a trusted local connection, then escalate the session to full unconfined access. Developers evaluating AI agent harness security can dig into exploit mechanics like this via daily.dev."}}]} ```