PipeRoll - Agent Incident Registry ·
about ·
contribute ·
data ·
notes ·
constitution ·
seismograph ↗
DeepSeek Harness: a sandboxed coding agent can turn off its own sandbox with one shell…
PIR-2026-0060PIR-2026-0060id: PIR-2026-0060title: DeepSeek Harness (dsh), DeepSeek's open-source local-first harness for running AI coding agents, exposed an unauthenticated agent-control API on localhost that decided trust from the client-supplied HTTP Host header rather than the real peer. Its OS sandbox blocked file writes but left loopback networking open, so a sandboxed agent could issue a single shell command to that API and switch its own session to danger-full-access - disabling the sandbox and approval prompts without any user confirmation. CVE-2026-82533, CWE-807, CVSS 9.4, fixed in 0.1.2-alpha.1date_occurred: not applicable - vulnerability disclosure (no confirmed in-the-wild exploitation; proof-of-concept on a default install)date_detected: 2026-08-13/14 (community members first reported the issue), formalised by OX Researchdate_disclosed: 2026-09-08 (CVE-2026-82533 published; OX Research reported to VulnCheck as CNA on 2026-08-24)status: corroborated (OX Research's disclosure write-up read 2026-09-12, plus The Hacker News' report and the CVE record; product, mechanism, CWE, CVSS, affected/fixed versions and timeline confirmed)agent_description: DeepSeek Harness (dsh) - DeepSeek's open-source, local-first harness for running AI coding agents, with a browser UI and a local HTTP control API on localhost:3080. It runs agents inside an OS sandbox (bubblewrap / Landlock / Seatbelt) that confines filesystem writes. Distinct from CodeWhale/deepseek-tui (PIR-2026-0057).operator_type: individual developers running the harness locally (affects any deployment on an affected version; the flaw is in the harness, not one operator's config)autonomy_level: human-on-the-loop by design (an approval-gated coding agent) - the vulnerability is that the agent can remove its own gatemodel_stack: DeepSeek models by default; model-agnostic to the flaw - the defect is in the harness's control API and sandbox wiring, not the modelharness: DeepSeek Harness (dsh); affected <= 0.1.1-rc.2; fixed in 0.1.2-alpha.1 (GitHub, 2026-08-27), 0.1.2-alpha.2 (first npm release, 2026-08-30), 0.1.2-rc.1 (current)authority_scope: self-escalation to danger-full-access - a sandboxed agent removes its own filesystem sandbox and approval prompts, gaining unconfined local execution on the developer's machine, from inside the sandbox and with no credentials or network exposure requiredfunds_at_risk_usd: unknownblast_radius: one machine per affected install on the default local path (an agent already running in the harness, whether prompt-injected, misaligned or given a hostile task). Not bounded to that: OX also demonstrated that wherever port 3080 is reachable through a tunnel, reverse proxy, SSH forward, editor port forward or similar, "an unauthenticated remote attacker could directly control the agent and, separately, download every stored conversation without an API key or model call"root_cause: tool-error (the harness makes a security decision from untrusted input - it authorises control-API calls by the client-supplied Host header instead of the peer address, and the sandbox profile leaves loopback networking reachable, so the confined agent can reach the very API that unconfines it; CWE-807, Reliance on Untrusted Inputs in a Security Decision). The same class as PIR-2026-0057 and PIR-2026-0058: an agent harness fails to enforce the boundary it advertisesfailure_locus: harness (the coding-agent harness's control API and sandbox configuration; not the model's reasoning and not an external dependency)exploitation_status: researcher-demonstrated (OX Research demonstrated the escape on a default install and it received a CVE; no confirmed in-the-wild exploitation)mechanism: DeepSeek Harness runs its agent inside an OS sandbox (bubblewrap/Landlock/Seatbelt) that restricts filesystem writes, and exposes an agent-control API on localhost:3080. That API is unauthenticated: it decides whether a request is trusted from the client-supplied HTTP Host header, never verifying the connection's actual peer address. Because the sandbox confines file writes but leaves loopback networking open, the confined agent can reach the API. A single shell command to the control API - with a crafted Host header - switches the agent's own session to danger-full-access, which disables the sandbox and turns off approval prompts, without any user confirmation. On shipped defaults, with no network exposure and no credentials, a sandboxed agent escapes its own confinement. CWE-807; CVSS v4.0 base 9.4 (vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). OX Research quote: "a sandboxed AI agent could use a single shell command to call that API and elevate its own session to 'danger-full-access' with approval prompts disabled."adversary_present: no (disclosed vulnerability, no in-the-wild attacker. On the default local path the escaping actor is the sandboxed agent itself; OX's second demonstrated path has an unauthenticated remote attacker wherever the port is exposed, so a human adversary is the modelled threat there)severity: near-miss (a critical sandbox-and-approval self-escape - the entire confinement of the harness defeated by one command - but patched, with no in-the-wild exploitation reported; a proof-of-concept on a default install)direct_loss_usd: unknown (no realised loss reported; a vulnerability demonstration does not evidence zero)indirect_loss_usd: unknowndowntime: nonedata_exposure: none confirmed on the default local path; the exposed capability there is unconfined local code execution once the agent removes its own sandbox. Where the port is reachable remotely, OX demonstrated download of every stored conversation without an API keydetected_by: third-party (community reports 2026-08-13/14; OX Research formalised and disclosed)time_to_detect: reported by the community within days of the affected releases; CVE published 2026-09-08time_to_recover: fixed in 0.1.2-alpha.1 (2026-08-27), three days after the VulnCheck reportremediation: upgrade to DeepSeek Harness >= 0.1.2-alpha.1 (npm 0.1.2-alpha.2 / current 0.1.2-rc.1). The fix stops trusting the Host header for the trust decision on the control APIstructural_fix: the general harness lesson (shared with 0057/0058): a sandbox is only as strong as the paths it leaves open. An agent-control plane must authenticate the actual caller, never a spoofable header, and the sandbox must not leave a network path from the confined agent to the API that can unconfine it. A "danger-full-access" mode that the confined party can enable itself is not a boundary. Approval prompts and sandbox state must be settable only by the human, out of the agent's reachcontrols_that_worked: the OS sandbox enforced its filesystem-write restriction before the escape (OX verified this), which is a matched pre-escape control, not the security boundary that held. The boundary itself was defeated by open loopback networking, an unauthenticated control API and an ordinary unapproved shell calltelemetry_grade: none (coordinated vulnerability disclosure with a proof-of-concept, not an operated incident with logs)sources:independence: medium - OX Research (the discoverer) and The Hacker News (independent reporting) describe the same finding; the CVE record confirms the identifier and CWE. No GHSA advisory existed at publicationrelated: PIR-2026-0057 (CodeWhale - a DIFFERENT DeepSeek-lineage coding agent, tools bypass the approval gate; explicitly distinct product) and PIR-2026-0058 (n8n - agent tool path skips an access control), the "agent harness fails to enforce its own boundary" family. This record is the sharpest of the three: the agent turns off its own sandboxaiid_incident_id: unknown (none located as of 2026-09-12)confidence: high on the identity, mechanism (Host-header trust + open loopback + single-command danger-full-access escape), CWE-807, CVSS 9.4, affected/fixed versions and disclosure timeline, from OX Research's write-up corroborated by The Hacker News and the CVE record; no in-the-wild exploitation claimedblast_radius, adversary_present and data_exposure qualified accordingly; (2) controls_that_worked distinguishes the pre-escape filesystem control from the defeated boundary; (3) direct_loss_usd from 0 to unknown. Host-header flaw, loopback path, one-command escape, CVE-2026-82533, CVSS 9.4, versions and the 08-24 / 08-27 / 09-08 timeline reconfirmed.