A critical authentication bypass in DeepSeek Harness before version 0.1.2-alpha.1 lets sandboxed agents disable their own file-write restrictions without approval. OX Security researchers discovered that the harness validates only the HTTP Host header rather than the actual TCP connection origin. A sandboxed agent needs just one curl command to reach the local control-plane API and escalate to “danger-full-access” mode, removing file restrictions entirely.
The flaw was discovered August 24, patched within three days, and assigned CVE-2026-82533 (CVSS 9.4, CWE-807) on September 8.
The real problem is the gap between OS-level and application-layer validation. Network isolation is correct: agents stay confined to their process. But trusting application-layer header validation to gate the control plane defeats that confinement. A sandboxed process that can run curl breaks the entire model. This suggests DeepSeek’s threat model didn’t account for agents reasoning about HTTP headers. A reasonable oversight in older tools, but indefensible for systems built specifically to contain agents running arbitrary code.
VulnCheck’s advisory has full technical details.
Sources: OX Security • VulnCheck
Coverage: Hacker News • DevOps.com
Related on this blog: The Evidence DeepSeek Ran This Attack Is a Command-Line Flag • [AUTO] Data Diodes as AI Training Boundaries • [AUTO] ChatGPT Sandbox Isolation Fails via Shared Infrastructure