What OX found
A coding agent running inside DeepSeek Harness’s sandbox could switch that sandbox off with a single curl command, OX Security disclosed on 8 September. The flaw, CVE-2026-82533, carries a CVSS 4.0 score of 9.4 and affects DeepSeek Harness 0.1.1-rc.2 and earlier.
DeepSeek Harness, or dsh, is DeepSeek’s open-source, local-first tool for running AI coding agents on a developer’s own machine. It pairs a browser interface with a local HTTP API on 127.0.0.1:3080, and according to OX it passed 215,000 GitHub stars within weeks of its August release. The bug was found by OX researchers Nir Zadok and Moshe Siman Tov Bustan.
A header where a password should be
The API had no real authentication. A function called isTrustedApiRequest read the Host header of each request and let it through if the value named a loopback address, but it never compared that value with the connection’s actual peer address. The Hacker News reports that a comment in the code itself described the check as “not an auth layer”.
That would have mattered less if the agent could not reach the API. It could. The sandbox restricted file writes but left loopback networking open, and ordinary bash tool calls did not need the user’s approval. The agent was also handed the interface address and its own session ID automatically, The Hacker News found, so there was nothing to discover. One curl command from inside the sandbox set the agent’s session to “danger-full-access” with approval set to “never”: sandbox off, prompts off, under default settings. OX says the agent then wrote files outside its workspace.
When the port leaves the laptop
The second scenario is remote. If port 3080 was reachable through a tunnel, a reverse proxy, an SSH forward or an editor’s port forwarding, an unauthenticated attacker could control the agent directly and download every stored conversation, without an API key or a model call, according to OX. Developers forward ports routinely to work on a remote machine from a laptop. The harness decided traffic was local because a header said so.
The fix, and which version to install
OX reported the flaw to VulnCheck, acting as the CVE numbering authority, on 24 August. DeepSeek pushed a fix to GitHub on 27 August in 0.1.2-alpha.1, OX re-tested and confirmed it on 30 August, and the CVE was published on 8 September. The patch adds one-time-token authentication: the browser exchanges the token for a signed cookie, and every API call requires that cookie.
OX’s advice is to upgrade to 0.1.2-alpha.1 or later. There is a wrinkle for npm users. The Hacker News found that 0.1.2-alpha.1 was never published to npm; the first patched npm build was 0.1.2-alpha.2 on 30 August, and the current release is 0.1.2-rc.1, published on 3 September. Anyone who installed through npm should confirm they are on one of those.
A quiet disclosure
DeepSeek’s release notes described the change as removing an old transport and requiring one-time-token authentication, with no security notice and no mention of the CVE, according to The Hacker News, which also found no security advisory or security policy in the repository. The same report says community developers had raised the escape and the unauthenticated interface in the project’s GitHub discussions on 13 and 14 August, more than a week before OX’s report, without a formal disclosure.
The harness’s own safety notice already warns that its sandboxing does not guarantee isolation, and the sandbox never confined file reads or network access. DevOps.com framed the case as part of a wider pattern of agent capabilities outpacing the controls meant to contain them.
What to watch
A sandbox that blocks writes but leaves localhost reachable is only as strong as every service listening on localhost. The things to watch are whether DeepSeek publishes a security advisory and a disclosure policy for the project, and whether a later release extends the sandbox to network access.
