Executive Summary
A flaw in DeepSeek Harness, its open-source tool for running AI coding agents locally, let a sandboxed agent turn off its own file sandbox with one command by calling the tool's own web API.
What Happened
A flaw in DeepSeek Harness, DeepSeek's open-source tool for running AI coding agents on a developer's machine, let a sandboxed agent turn off its own sandbox with a single command. The tool runs an agent's commands inside an operating-system sandbox, so that an agent working on untrusted files cannot write outside its workspace. The agent could remove that limit by calling the tool's own web
Affected Products
- DeepSeek Harness
Vulnerability / Attack Technique
Agent disabling its own sandbox
Technical Mechanism
The harness runs agent commands in an OS sandbox, but the agent could call the harness's web API to remove the restriction without approval.
AI Security Category
LLM06:2025 Excessive Agency
Part of the AI Agent Excessive Agency topic.
Relevant Frameworks
RealGround Analysis
A sandbox the agent can switch off is not a sandbox. RealGround analysis: sandbox controls must not be reachable from inside the sandbox.
Recommended Controls
- Update DeepSeek Harness
- Block agent access to the harness's control API
- Run coding agents in containers or VMs as a second layer
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/09/deepseek-harness-flaw-let-ai-agents.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.