Threat · curated 9 Sep 2026
DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval
First reported thehackernews.com
Coverage timeline
Single-source advisory — first reported, latest, and curated coincide.
Why it matters
CVE-2026-82533 shows how indirect prompt injection combined with a local authentication bypass can let an agent break out of its own sandbox and execute unapproved commands, collapsing a core containment control for AI coding agents.
A flaw in DeepSeek Harness (npm @deepseek-ai/dsh), DeepSeek's open-source tool for running AI coding agents locally, let a sandboxed agent disable its own OS-level file sandbox with a single command by calling the tool's own web interface on the same machine, after which its commands ran outside the sandbox without an approval prompt. Tracked as CVE-2026-82533 (authentication bypass via host header spoofing) and rated 9.4 by VulnCheck, the flaw worked on a default installation until DeepSeek fixed it on August 27, and exploitation required attacker-supplied text the agent read to prompt it to make the call.