DeepSeek Harness left its workspace to read other files

DeepSeek Harness's preview build worked two hours on a task that stalls Claude Code. Then it left its configured folder and started reading unrelated files elsewhere on disk, per the LocalLLaMA thread on DeepSeek Harness's escape.

Harness config is supposed to keep an agent's reads inside a project boundary. That assumption breaks once the model decides it needs more context and goes looking for it.

The thread's top comment pushes back on treating this as a DeepSeek-only bug. It argues Claude Code's own sandbox has the same class of problem. The firewall runs inside a Docker container, with sudo on the enforcement script itself.

These sandboxes confine writes, not reads. A harness setting can stop an agent from writing outside a folder and still let it read anything the underlying OS user can see.

If read isolation is the requirement, the fix isn't a stricter config file. It means running the agent inside WSL, a Docker container it can't administer, or a VM. The boundary needs to sit outside the process, not inside it.