Critical Sandbox Escape Vulnerability in DeepSeek Harness Lets AI Agents Disable Protections with One Command
Security researchers from OX Research have disclosed a high-severity vulnerability in DeepSeek Harness, an open-source framework designed to let AI agents safely work with code and files on a developer’s local machine.
The flaw, assigned CVE-2026-82533 and rated 9.4 out of 10, enabled an AI agent to disable its own protective sandbox using a single command. In normal operation, the sandbox prevents the agent from writing data outside its designated working directory and requires explicit user confirmation for sensitive actions.
By sending a request to the tool’s local web interface, the agent could switch its active session into danger-full-access mode. This change instantly removed all write restrictions and eliminated confirmation prompts. The attack could be initiated via prompt injection: an adversary would embed a malicious instruction inside a file or other content that the agent later analyzed.
The web interface did not require any authentication. Trust decisions were based solely on the Host header, which an attacker could spoof. In addition, the interface address and current session identifier were automatically passed into the agent’s environment variables, making exploitation straightforward.
The vulnerability impacted all versions up to and including 0.1.1-rc.2. A fix was published on GitHub on 27 August, with the first protected npm release being 0.1.2-alpha.2. The current stable build, 0.1.2-rc.1, also contains the patch. Developers are advised to update at minimum to 0.1.2-alpha.2 and to audit any third-party wrappers that embed Harness.
When an update is not feasible, users should disable the web interface entirely and remove any proxies, tunnels, or port forwards that expose it. Researchers also noted that the same unauthenticated interface could be used to download logs of every stored conversation.
DeepSeek had previously stated that its sandbox and confirmation mechanisms do not provide complete isolation, underscoring the need for additional hardening when running AI agents with local system access.
Related articles
Agentic AI Systems Under Siege: Prompt Injections, Data Poisoning, and Tool Exploits
Independent expert Andrey Biryukov details how AI agents with file access, email capabilities, and API calls become high-value targets for attackers. The article examines confidentiality, integrity, and availability risks created by autonomous decision-making. Real-world examples include NeuralTrust’s discovery of malicious URL instructions bypassing OpenAI Atlas validation and Zscaler ThreatLabz’s demonstration of hidden instructions on fake Python documentation sites that tricked models into making cryptocurrency payments. Data poisoning research from Carnegie Mellon and Cornell Tech showed agents from Anthropic, OpenAI, and Google selecting tampered datasets in half of tested cases. Additional findings cover vulnerabilities in Git MCP Server and comparative weaknesses between Function Calling and Model Context Protocol architectures. OWASP’s Agentic Top 10 and joint guidance from Canada, Australia, the US, New Zealand, and the UK emphasize threat modeling, least-privilege isolation, and separation of trusted versus untrusted data.
How to Build an AI Agent for Pentesting Without Turning It Into a Black Box
Most security specialists use language models as advanced references where the human reviews every suggestion before execution. With autonomous AI agents the workflow changes dramatically as the agent plans steps, calls tools, analyzes outputs and maintains memory across multiple iterations. This automation introduces serious risks because specialists may see only the final result without understanding which hypotheses were tested or why specific commands were chosen. CyberED and Standoff Hackbase are running a practical AI pentesting challenge to help participants build controllable agents. The event includes a live webinar on 10 September followed by a week-long hands-on period on the Standoff Hackbase training range. Experts emphasize defining strict technical boundaries, logging every decision, and keeping high-risk actions under human oversight.
AI Agents Remember Everything: Privacy Risks of Persistent Memory
AI agents are advanced models capable of calling external and internal tools while cycling through complex tasks. They retain extensive memory of user actions, model responses, tool usage, and all related interactions. This design allows agents to learn user preferences such as specific formatting rules or language choices after a single explanation. Personalization improves efficiency but creates detailed profiles of communication styles, habits, and personal information. The stored data raises questions about what a personal AI assistant might remember and with whom that information could be shared. The article from Selectel highlights how convenience in AI agents directly conflicts with user privacy expectations.
AI Detection Agents Shift Cybersecurity from Alerts to Autonomous Investigations
AI-powered detection agents are redefining how organizations identify and respond to cyber threats by moving beyond simple signature matching and alert generation. Instead of forwarding isolated events to human teams, these agents now perform initial investigations themselves, correlating telemetry from multiple sources and reconstructing attack chains before escalating any incident. The technology has progressed from theoretical discussions to active budget conversations, forcing security teams to evaluate how much triage work can be handled autonomously. Traditional monitoring systems deliver chronological events and leave analysts to connect the dots manually, while the new agents handle correlation, timeline verification, and scope assessment upfront. Attack automation has increased the urgency, as malicious actions can now produce effects faster than human analysis can complete. The agents collect artifacts, review asset history, check for repeated behavior, and determine the real impact, redistributing analyst workload without removing the need for human judgment on business impact and response decisions.