DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval

A flaw in DeepSeek Harness, DeepSeek's open-source tool for running AI coding agents on a developer's machine, let a sandboxed agent turn off its own sandbox with a single command. The tool runs an agent's commands inside an operating-system sandbox, so that an agent working on untrusted files cannot write outside its workspace. The agent could remove that limit by calling the tool's own web

Reported facts: A flaw in DeepSeek Harness, an open-source tool for running AI coding agents on a developer’s machine, allowed a sandboxed agent to disable its own operating-system sandbox with a single command, removing restrictions that prevent writes outside its designated workspace. This meant an agent working on untrusted files could potentially gain broader file system access without explicit user approval. RealGround analysis: This is a direct AI agent containment failure, showing that agent frameworks must treat sandbox controls as non-bypassable security boundaries and rigorously validate any self-modifying or configuration-changing commands. Organizations using code-executing agents should implement independent controls and continuous red teaming to detect and prevent sandbox escape paths before deployment.