DeepSeek Harness CVE-2026-82533: the agent unlocked itself

VulnCheck published the record on September 8, and it is the failure mode everyone running a self-hosted agent runtime should have been worried about. DeepSeek Harness CVE-2026-82533 — CVSS 9.4 — let an AI agent turn off its own file sandbox with a single call to the local interface, and let an outsider who could reach that interface take over the agent and pull down stored conversations. No API key. No model call. The fence was real. The gate was unlocked from the inside.

What actually happened

The Harness local web interface authenticated requests by reading the client-supplied Host header instead of checking the actual TCP connection origin. Anything claiming to be localhost was treated as localhost. That is the whole bug. VulnCheck's advisory scores it CVSS 9.4 (AV:N/AC:L/PR:N/UI:P) and describes the payoff plainly: spoof the header, gain full agent control, invoke privileged commands.

The privileged command that matters is the one that flips the session into danger-full-access — a mode that disables the sandbox and stops approval prompts. An agent that could reach its own control plane could therefore grant itself write access outside its workspace and stop asking permission first. The same unauthenticated interface also exposed session logs, which on a coding agent means whatever you pasted into it.

Versions 0.1.1-rc.2 and earlier are affected. DeepSeek fixed it in 0.1.2-alpha.1 on GitHub on August 27, published 0.1.2-alpha.2 to npm on August 30, and 0.1.2-rc.1 is the current npm release as of September 3. OX Research reported the flaw to VulnCheck on August 24; community members had described the same escape in GitHub discussions around August 13. If you installed Harness during its August developer-preview wave and pinned a version, check it today.

Why agent sandbox escapes matter for your business

We wrote about Harness when DeepSeek open-sourced it under MIT, because owning your agent loop is genuinely the right call. This is the tax on that call: when you self-host the runtime, its listening ports are your listening ports.

Three things to check this week, on Harness or on anything else that wraps a model in a loop:

Find the control plane. Most agent runtimes bind an HTTP interface on localhost for the UI and the CLI to talk to. Run netstat or lsof -i on the box and look. If a header can authenticate to it, it is not authenticated.

Assume approval prompts are advisory. Harness's own safety docs say sandboxing and prompts do not guarantee isolation. Believe them. The durable control is what credentials exist on that machine and what the network lets it reach — not a dialog the agent can route around.

Pin and patch, don't pin and forget. This one shipped its first fix on GitHub three days before it reached npm. If your lockfile points at an alpha from a fast-moving preview, you own that gap.

Sources: VulnCheck advisory, The Hacker News.