A vulnerability in DeepSeek Harness allowed a sandboxed AI coding agent to disable its own sandbox without an extra approval prompt. The flaw arose because the tool’s local web interface, which the agent can reach from inside its environment, did not require authentication and relied on a Host header check that treated any request claiming to be local as trusted.
An attacker could trigger a single shell command that targeted the interface and switched the agent’s session to a mode called danger-full-access, effectively turning off the sandbox and permitting writes and other actions beyond the workspace. The exposure was demonstrated on the default installation, with the issue specifically enabling access to the interface and its session details, including the address and session ID, without user approval.
Affected versions and fixes are detailed by VulnCheck as CVE-2026-82533. DeepSeek Harness versions 0.1.1-rc.2 and earlier were affected. A fixed version was named 0.1.2-alpha.1, but that release was never published to npm; subsequent npm releases began with 0.1.2-alpha.2 and then 0.1.2-rc.1, with the first widely available fix on npm appearing as 0.1.2-alpha.2 and 0.1.2-rc.1 by early September 2026.
The fix introduces a one-time-token authentication mechanism: the interface now presents a startup token, exchanges it for a signed cookie, and requires the cookie for all calls. The underlying sandbox policy (reads and network access not being confined) remains unchanged, and the tool’s own documentation notes that sandboxing does not guarantee isolation.
Practical guidance from the report urges upgrading to 0.1.2-alpha.2 or later, and, if upgrading is not possible, to disable or remove exposure to the web interface and any tunnels or port forwards that reach it.