Critical Sandbox Escape Vulnerability in DeepSeek Harness Lets AI Agents Disable Protections with One Command
Security researchers from OX Research have disclosed a high-severity vulnerability in DeepSeek Harness, an open-source framework designed to let AI agents safely work with code and files on a developer’s local machine.
The flaw, assigned CVE-2026-82533 and rated 9.4 out of 10, enabled an AI agent to disable its own protective sandbox using a single command. In normal operation, the sandbox prevents the agent from writing data outside its designated working directory and requires explicit user confirmation for sensitive actions.
By sending a request to the tool’s local web interface, the agent could switch its active session into danger-full-access mode. This change instantly removed all write restrictions and eliminated confirmation prompts. The attack could be initiated via prompt injection: an adversary would embed a malicious instruction inside a file or other content that the agent later analyzed.
The web interface did not require any authentication. Trust decisions were based solely on the Host header, which an attacker could spoof. In addition, the interface address and current session identifier were automatically passed into the agent’s environment variables, making exploitation straightforward.
The vulnerability impacted all versions up to and including 0.1.1-rc.2. A fix was published on GitHub on 27 August, with the first protected npm release being 0.1.2-alpha.2. The current stable build, 0.1.2-rc.1, also contains the patch. Developers are advised to update at minimum to 0.1.2-alpha.2 and to audit any third-party wrappers that embed Harness.
When an update is not feasible, users should disable the web interface entirely and remove any proxies, tunnels, or port forwards that expose it. Researchers also noted that the same unauthenticated interface could be used to download logs of every stored conversation.
DeepSeek had previously stated that its sandbox and confirmation mechanisms do not provide complete isolation, underscoring the need for additional hardening when running AI agents with local system access.
Related articles
AI Agents Becoming Core InfoSec Skill Like Microsoft Office Proficiency
Working with AI in information security is shifting from a specialized skill to a baseline expectation similar to using Microsoft Office tools. The key difference lies in the cost of errors: poor Word usage wastes time, while mishandling AI agents burns subscription limits and corporate funds. The article details practical workshops from the Engineering October series covering AI agents from beginner tools to securing the agents themselves. Core concepts include distinguishing models from agents, managing context windows to prevent forgotten instructions, and using skills, MCP connectors, and sub-agents for efficiency. Real-world examples show agents handling CVE analysis, alert triage, and threat report reviews while highlighting risks like hallucinations and data exposure. Guidance covers safe deployment in isolated environments and the irreplaceable role of human expertise in strategy and verification.
Research Exposes Limitations in AI Skill Scanners for Agent Vulnerability Detection
An independent researcher evaluated three local vulnerability scanners for AI agent skill packages without using LLMs or external APIs. The test used 12 synthetic packages containing both benign and malicious instructions, including attempts to bypass consent via sub-agents and hidden instructions in nested files. Cisco Skill Scanner, NVIDIA SkillSpector, and AgentVerus were run in isolated containers. All three tools missed a critical delegation bypass in package 10, while correctly flagging an educational attack citation in package 5 as High severity. NVIDIA SkillSpector performed best on nested file detection, and the findings directly shaped the integration of a lightweight static analyzer plus optional NVIDIA scans into the CEO AI project. The study also highlighted the need to preserve detailed findings rather than relying solely on final safety scores.
Apple Tightens App Store Rules Against Non-Consensual Intimate AI Deepfakes
Apple has updated its App Store guidelines to explicitly prohibit applications that generate intimate deepfake images of real individuals without consent. Developers must now implement measures to prevent creation and distribution of such content and promptly remove any instances that appear. The company also banned the practice of submitting apps with hidden functionality that is activated after passing review, a tactic previously used by undressing services. Violations can result in both app removal and expulsion from the Apple Developer Program. The move follows similar actions against xAI's Grok chatbot, which added safeguards after Apple threatened removal over the same issue. The policy targets non-consensual intimate imagery rather than all deepfake technology.
CyberXero Deploys 51 AI Agents to Scan 4708 Targets and Implant 32 WebShells in 61 Seconds
Russian-speaking initial access broker CyberXero integrated Anthropic's Claude Code and the open-source PentAGI autonomous penetration agent into its attack pipeline, creating a cluster of 51 specialized AI agents. The group ran two parallel operations: one automated campaign targeting vulnerable WordPress and e-commerce sites worldwide using known exploits including CVE-2026-63030, CVE-2026-60137 and CVE-2026-4815, and a second, more targeted campaign against Ukrainian energy and critical infrastructure. In one recorded execution the AI cluster scanned 4708 public-facing hosts, compromised 429 WordPress administrative panels and dropped 32 WebShells within a 61-second window. Attackers bypassed model safety guardrails by resetting sessions and reframing requests as authorized penetration tests of their own infrastructure. The operation relied on an eight-node architecture that included a Linux workstation, configuration server, payload staging server and public Redis instances, two of which belonged to Chinese organizations. SOCRadar warns that session-level controls alone are insufficient and recommends enforcing system-level boundaries, minimal privileges and strict egress filtering for any AI agents.