DeepSeek Harness CVE-2026-82533 Lets Sandboxed AI Agents Disable Their Own Confinement

OX Security disclosed CVE-2026-82533 on September 8, 2026: a critical flaw in DeepSeek Harness (dsh), DeepSeek’s open-source local-first AI coding-agent harness, that let a sandboxed agent disable its own confinement on shipped defaults—no network exposure and no credentials required. The issue is tracked as CWE-807 with CVSS 9.4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). Affected builds are 0.1.1-rc.2 and earlier; the fix is 0.1.2-alpha.1.

DeepSeek Harness presents a browser UI backed by a local HTTP API on 127.0.0.1:3080. OX reports the product reached more than 215,000 GitHub stars shortly after its August 2026 release. The harness sandboxes agent commands with bubblewrap, Landlock, or Seatbelt depending on platform, specifically to bound a coding agent’s ambient authority when handling untrusted material.

How the trust check failed

OX traced the bug to isTrustedApiRequest, which decided whether a request was trusted solely from the client-supplied Host header (loopback authority or a configured trustedHosts list) without verifying the connection’s peer address. That blocked classic browser DNS rebinding but allowed any client that could set Host to claim a trusted authority. Separately, OS sandbox profiles restricted filesystem writes while leaving loopback networking open, and ordinary shell tool calls did not require approval. Together, a confined agent could call the unauthenticated local control API and elevate its session to danger-full-access with approval set to never, after which commands ran unconfined and unprompted.

Remote path and disclosure timeline

If the same port was reachable beyond the host—via tunnel, reverse proxy, SSH or editor port forward—OX says an unauthenticated remote attacker could take full control of the agent and separately export every stored conversation without an API key. Disclosure timeline per OX: vulnerability confirmed and reported to VulnCheck as CNA on August 24, 2026; remediated in 0.1.2-alpha.1 on August 27; OX retested and confirmed the fix on August 30; CVE-2026-82533 published September 8.

Operators should upgrade DeepSeek Harness to 0.1.2-alpha.1 or later, keep the control port off untrusted networks, and treat any default 0.1.1-rc.2-or-earlier install that ran untrusted agent content as potentially escalated.

Primary source for this brief is OX Security’s CVE-2026-82533 advisory (https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/).