Summary
- CVE-2026-82533 allowed a confined DeepSeek Harness agent to use the local control plane to remove its own restrictions.
- OX Research demonstrated the flaw on the shipped default configuration after attacker-supplied text induced the agent to make the call.
- DeepSeek fixed the issue in Harness 0.1.2-alpha.1, and VulnCheck assigned the vulnerability a CVSS 4.0 score of 9.4.
A critical vulnerability in DeepSeek Harness allowed a sandboxed AI coding agent to disable its own confinement by calling the application’s local control interface, exposing a weakness in the separation between an autonomous agent and the controls intended to constrain it.
The vulnerability, CVE-2026-82533, affects DeepSeek Harness versions before 0.1.2-alpha.1 and carries a CVSS 4.0 score of 9.4.
Harness is an open-source environment for running AI coding agents on a developer’s machine. Commands generated by an agent can execute inside an operating-system sandbox designed to prevent writes outside the assigned workspace.
Researchers at OX Security found that the sandbox continued to permit loopback network connections. At the same time, Harness exposed a local HTTP control-plane API that determined whether a request was trusted using a client-supplied Host header rather than verifying the actual source of the connection.
Those design choices could be combined. From inside the sandbox, an agent could call the local API and change its own session policy to danger-full-access, while also disabling the approval prompts that would ordinarily govern less restricted execution.
OX demonstrated the escape on a default installation. The researchers first confirmed that the sandbox blocked a write outside the workspace, then showed that an otherwise equivalent session could perform the same write after the agent had altered its policy through the local API.
No external network exposure or credentials were required for that path. The precondition was that attacker-supplied content processed by the agent caused it to execute the control-plane call.
That makes prompt injection part of the exploitation model, but the underlying failure sits below the model itself. The operating-system sandbox did not need to be broken through a kernel or filesystem exploit. Instead, the application surrounding the sandbox provided a more privileged interface through which the protected component could instruct the system to remove its restrictions.
VulnCheck says the same authentication weakness created a separate risk where the local control port became reachable through a tunnel, proxy, SSH forwarding or another network path. In that scenario, an unauthenticated remote attacker could invoke privileged agent functions and retrieve stored conversations.
DeepSeek released version 0.1.2-alpha.1 on 27 August, and OX said it subsequently retested the version and confirmed that the issue had been fixed. CVE-2026-82533 was published on 8 September.
Boris Cipot, principal security engineer at Black Duck, said: “This vulnerability is a reminder that the security of AI agents depends not only on the underlying operating system, but also on how the agent’s control mechanisms are designed and protected.”
The design issue extends beyond DeepSeek. Coding agents increasingly operate with access to shells, package managers, repositories and credentials available to the developer account under which they run. A prompt-injection event in that environment can become an execution problem if the agent is able to reach privileged management interfaces that were designed on the assumption that local access was inherently trusted.
The separation of enforcement from the protected component is therefore critical. A sandbox provides much weaker assurance if the confined agent can communicate with another local service that has authority to relax the sandbox policy on its behalf.
The case also shows why local interfaces cannot automatically be treated as outside the attack surface. Loopback-only services may still be reachable by applications, agents and processes operating on the same machine, including components processing attacker-controlled input.
There is no evidence in the material reviewed that CVE-2026-82533 has been exploited against real organisations. The confirmed evidence is a researcher-demonstrated sandbox escape on the default configuration and a second unauthenticated control path where the local API is made reachable.
That distinction does not reduce the architectural significance of the flaw. AI agents are being granted increasing authority precisely because they can act autonomously. The controls around those agents need to remain effective when the agent processes malicious instructions, rather than depending on the agent choosing not to interact with the mechanism that protects it.
