---
title: "[AUTO] DeepSeek Harness Agent Sandbox Bypass"
pubDatetime: 2026-09-09T20:06:00.000Z
description: "Critical vulnerability in DeepSeek Harness lets sandboxed AI agents disable their own confinement with a single curl command."
tags: [ai-security, ai-agents, vulnerability, sandboxing, deepseek, 2026, 2026-q3, 2026-09, AUTO]
---
A critical authentication bypass in [DeepSeek Harness](https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/) before version 0.1.2-alpha.1 lets sandboxed agents disable their own file-write restrictions without approval. OX Security researchers discovered that the harness validates only the HTTP Host header rather than the actual TCP connection origin. A sandboxed agent needs just one curl command to reach the local control-plane API and escalate to "danger-full-access" mode, removing file restrictions entirely.

The flaw was discovered August 24, patched within three days, and assigned CVE-2026-82533 (CVSS 9.4, CWE-807) on September 8.

The real problem is the gap between OS-level and application-layer validation. Network isolation is correct: agents stay confined to their process. But trusting application-layer header validation to gate the control plane defeats that confinement. A sandboxed process that can run curl breaks the entire model. This suggests DeepSeek's threat model didn't account for agents reasoning about HTTP headers. A reasonable oversight in older tools, but indefensible for systems built specifically to contain agents running arbitrary code.

[VulnCheck's advisory](https://www.vulncheck.com/advisories/deepseek-harness-alpha-1-authentication-bypass-via-host-header-spoofing) has full technical details.

---

*Sources: [OX Security](https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/)  •  [VulnCheck](https://www.vulncheck.com/advisories/deepseek-harness-alpha-1-authentication-bypass-via-host-header-spoofing)*

*Coverage: [Hacker News](https://thehackernews.com/2026/09/deepseek-harness-flaw-let-ai-agents.html)  •  [DevOps.com](https://devops.com/flaw-in-deepseek-harness-ai-coding-tool-let-agents-disable-their-sandbox/)*

*Related on this blog: [The Evidence DeepSeek Ran This Attack Is a Command-Line Flag](/posts/deepseek-flag-attribution-honeypot)  •  [[AUTO] Data Diodes as AI Training Boundaries](/posts/auto-data-diodes-ai)  •  [[AUTO] ChatGPT Sandbox Isolation Fails via Shared Infrastructure](/posts/auto-chatgpt-sandbox-isolation-breach)*