+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: News and Happenings (https://hackforums.net/forumdisplay.php?fid=89)
+---- Thread: CVE-2026-82533: DeepSeek Harness Vulnerability Lets AI Agents Escape Its Own Sandbox (/showthread.php?tid=6331653)
CVE-2026-82533: DeepSeek Harness Vulnerability Lets AI Agents Escape Its Own Sandbox - MadScientist - Sep 10, 2026
OX Research found and disclosed a critical vulnerability in DeepSeek Harness, DeepSeek’s open-source AI coding-agent harness, that allowed a sandboxed AI agent to disable its own confinement with a single shell command – on shipped defaults, with no network exposure and no credentials.
Vulnerability Details
CVE: CVE-2026-82533
CWE: CWE-807 Reliance on Untrusted Inputs in a Security Decision
CVSS: 9.4
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Description: DeepSeek Harness exposed its agent-control API on a local HTTP port without authentication, relying solely on the client-supplied ‘Host’ request header to determine whether a request was trusted rather than verifying the connection’s actual peer address. Because the product’s OS sandbox restricted file writes but left loopback networking open, a sandboxed agent could use a single shell command to call that API and elevate its own session to ‘danger-full-access’ with approval prompts disabled — effectively disabling its own sandbox on the shipped default configuration. If the port was exposed to a network, the same interface also allowed an unauthenticated remote attacker to take full control of the agent and export every stored conversation without a key.
Read More - https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/
RE: CVE-2026-82533: DeepSeek Harness Vulnerability Lets AI Agents Escape Its Own Sandbox - XtremeDiscount - Sep 10, 2026
Oh wow, thanks for the read. That's cool you can make it escape the sandbox