DeepSeek Harness flaw let AI agents disable their own sandbox

OX Research found that DeepSeek Harness 0.1.1-rc.2 and earlier exposed a local web UI guarded by nothing more than a Host-header check, according to The Hacker News. An agent steered by attacker-supplied text, a poisoned prompt, a malicious file, whatever it happened to read, could send that UI one shell command and flip its own session to "danger-full-access." That mode turns off file restrictions and approval prompts. The bug is tracked as CVE-2026-82533 and scored 9.4 on the CVSS scale.

The fix in version 0.1.2-rc.1 adds a one-time startup token that exchanges for signed cookies, so the control panel now checks who's asking instead of just where the request claims to come from.

The attacker here isn't a remote actor probing the network. It's the agent itself, doing exactly what it was told by text it processed as part of its normal job. A Host-header check assumes the only thing hitting localhost is the user. An agent with shell access and a goal is also hitting localhost, and it has no way to tell the difference between the user's intent and an instruction buried in a web page it fetched.

The pattern isn't specific to DeepSeek. Any agent framework running a local control panel for session settings, approval state, or permission scopes needs real authentication on that panel, not network-position trust. A Host header alone tells you nothing about whether the request came from a person or from the agent acting on hostile text.