# DeepSeek Harness Flaw Exposes AI Agents to Security Risks

*Published September 11, 2026*
*Source: [https://thehackernews.com/2026/09/deepseek-harness-flaw-let-ai-agents.html](https://thehackernews.com/2026/09/deepseek-harness-flaw-let-ai-agents.html)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/deepseek-harness-flaw-exposes-ai-agents-to-security-risks) or [see plans](https://www.sec-news.ai/pricing).*

## Article

A significant security flaw was identified in DeepSeek Harness, an open-source tool designed to run AI coding agents on developer machines. This flaw allowed sandboxed AI agents to disable their own file sandbox with a single command, potentially granting them unauthorized access to host files. The issue was rooted in the tool's ability to accept commands through its own web interface without requiring user approval, effectively bypassing the sandbox restrictions. This vulnerability, tracked as CVE-2026-82533, was discovered by OX Research and rated 9.4 out of 10 by VulnCheck, highlighting its severity. The flaw was found to be exploitable through a single shell command that could change the agent's session to a mode called danger-full-access, which removes sandbox constraints and eliminates approval prompts. DeepSeek Harness has since addressed this issue with a fix implemented on August 27, which introduced an identity check requiring a one-time token for interface access. However, the fix did not address all potential security gaps, as the tool continues to allow reads and network access outside the sandbox. Developers utilizing third-party builds of the harness should verify which version they are using, as some may still be vulnerable. The project has not published a security advisory or implemented a security policy, leaving users without formal guidance on mitigating risks. DeepSeek Harness's own safety notice advises against relying solely on the tool for security, underscoring the need for additional protective measures when handling untrusted code.