# DeepSeek Harness Authentication Bypass Lets Sandboxed AI Agents Escape via Single Command (CVE-2026-82533)

> DeepSeek Harness (CVE-2026-82533, CVSS 9.4 Critical) contains an authentication bypass in its local HTTP control-plane API: the isTrustedApiRequest function validates only the client-supplied Host header rather than the actual TCP connection origin. A sandboxed AI agent can exploit this with a single curl command to disable its own sandbox and approval prompts, and remote attackers reaching the port via tunnel or proxy gain full agent control and access to all stored conversations without credentials.

- **Published:** 2026-09-09T00:00:00Z
- **Last reviewed:** 2026-09-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2412
- **ID:** TL-2026-2412
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-82533

## Description

DeepSeek Harness (dsh) is an open-source, local-first AI coding-agent harness that has rapidly amassed over 216,000 GitHub stars since its launch in August 2026. It runs AI coding agents on a developer's machine with OS-level filesystem sandboxing (Bubblewrap on Linux, Seatbelt on macOS, ACL-restricted-token on Windows) and an approval-prompt system intended to gate dangerous operations. The tool ships as the npm package @deepseek-ai/dsh and its CLI binary dsh, with version 0.1.1-rc.2 as the latest npm release. The harness exposes a local HTTP control-plane API on 127.0.0.1:3080 to manage agent sessions, execute commands, and retrieve conversation logs.

CVE-2026-82533, discovered by OX Security researchers Nir Zadok and Moshe Siman Tov Bustan, resides in the isTrustedApiRequest function within packages/client/connection/src/api-request-trust.ts. This function serves as the sole gate for the entire /api RPC surface. It reads the client-supplied Host header to determine trust — if the Host value matches a loopback address (127.0.0.1 or localhost) or appears in a configured trustedHosts list, access is granted. Crucially, the function never compares the Host value against the actual TCP connection peer address. The function's own code comments acknowledge this is a trust boundary designed to prevent DNS rebinding and CSRF from browsers, but it is explicitly documented as "not an auth layer." Non-browser clients (such as a curl command from within a sandboxed agent) can simply supply a spoofed Host: 127.0.0.1:3080 header and bypass the gate entirely.

The attack chain for sandbox escape is straightforward. The sandbox profiles on both Linux (Bubblewrap, using --unshare-pid but not --unshare-net) and macOS (Seatbelt, using (allow default) with only (deny file-write*)) leave loopback networking open while restricting filesystem writes. Ordinary bash tool calls require no approval. From inside the sandbox, an agent executes a single curl command: curl -s -X POST http://127.0.0.1:3080/api/session/update-config -H "Host: 127.0.0.1:3080" -H "Content-Type: application/json" -d '{"danger-full-access": true, "approval": "never"}'. This sets the session to danger-full-access mode (which disables the sandbox entirely) and approval to never (which stops all approval prompts). The session log records the policy change with source: {kind: 'user'} — the harness cannot distinguish the agent's shell from the human at the keyboard, and no approval/request event appears anywhere in the log. OX Research verified the exploit by running two identical sessions from default settings: the session that made the API call successfully wrote files outside its workspace (e.g., /home/ubuntu), while the confined session had the identical write blocked by the sandbox.

The remote attack path is equally severe. If port 3080 is reachable via SSH tunnel, reverse proxy, editor port forward, or the --host 0.0.0.0 option (which the CLI explicitly refuses but can be bypassed via proxy), an unauthenticated remote attacker gains full agent control: they can invoke commands/execute with danger-full-access permissions, read all stored conversations, and enumerate the filesystem via host.listDirectory and host.createDirectory — all without any credential or API key. The --profile web binding explicitly rejects --host 0.0.0.0, confirming the threat model includes local actors.

Beyond CVE-2026-82533, the vulnerability is part of a broader security picture for DeepSeek Harness. The same week the CVE was reported, community researchers published three additional vulnerabilities under discussion #451 (DSH-01, DSH-02, DSH-03): DSH-01 is a node:vm sandbox escape in the workflow tool (CVSS 8.8) where the constructor chain agent.constructor('return process')().getBuiltinModule('fs') bypasses the VM context entirely, achieving arbitrary file read/write and RCE; DSH-02 is a dynamic plugin host code escape via host-realm closure (CVSS 8.8) where btoa.constructor obtains the host Function constructor, enabling full process-level access including reading DEEPSEEK_API_KEY from process.env; and DSH-03 is the identical /api RPC bridge without authentication (the same class as CVE-2026-82533 but documented independently). A subsequent security audit (discussion #817) reported 7 additional findings: 2 High (unauthenticated LAN RPC when binding to 0.0.0.0, and the unpinned host-filesystem primitives the RPC carries) and 5 Medium (workflow tool bypassing sandbox modes, approval escalation not bound to the command, host-only dynamic packages activating with zero approval, sandbox context facade forwarding capability services, and Landlock falsely reporting full enforcement on NFS/CIFS/FUSE filesystems).

The project has no SECURITY.md file, and GitHub's private vulnerability reporting returns API 403, meaning there was no responsible disclosure path available. The fix was released in dsh-v0.1.2-alpha.1 on August 27, 2026 (commit 3e24087bfaeabe40b58ba2f7b936895b8f93fe27), implementing a one-time-token authentication scheme where the tool prints a token at startup, the browser exchanges it for a signed cookie, and every API call requires the cookie. However, the fix does not address the design limitations that the sandbox does not confine reads, network access, or process visibility, and the agent's shell still receives the interface address. The fix was first available on npm in version 0.1.2-alpha.2 (August 30) and the current npm release with the fix is 0.1.2-rc.1 (September 3). Third-party desktop builds that ship their own copy of the harness remain exposed until they update their pinned version.

A separate academic study (arXiv:2608.16393, August 2026) assessed DeepSeek Harness resistance to indirect prompt injection across 14,560 controlled agent executions, finding fake-completion attacks achieved 17.0% success, hidden unicode in files reached 25.5%, and the skills channel reached 16.0%, confirming that the broader attack surface extends well beyond the authentication bypass. No in-the-wild exploitation of CVE-2026-82533 has been reported as of publication.

## MITRE ATT&CK

- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1071.001 Application Layer Protocol: Web Protocols
- T1685 Disable or Modify Tools
- T1548 Abuse Elevation Control Mechanism
- T1190 Exploit Public-Facing Application
- T1213 Data from Information Repositories
- T1082 System Information Discovery
- T1204.002 User Execution: Malicious File
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1552.001 Unsecured Credentials: Credentials in Files

## Sources

- [OX Security: CVE-2026-82533 — DeepSeek Harness AI Agent Sandbox Escape](https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/)
- [VulnCheck Advisory: DeepSeek Harness Authentication Bypass via Host Header Spoofing](https://www.vulncheck.com/advisories/deepseek-harness-alpha-1-authentication-bypass-via-host-header-spoofing)
- [The Hacker News: DeepSeek Harness Flaw Lets AI Agents Escape Sandbox With a Single Command](https://thehackernews.com/2026/09/deepseek-harness-flaw-let-ai-agents.html)
- [NVD Entry: CVE-2026-82533](https://nvd.nist.gov/vuln/detail/cve-2026-82533)
- [GitHub Release: dsh-v0.1.2-alpha.1 (Fix)](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1)
- [GitHub Commit: Fix for CVE-2026-82533](https://github.com/deepseek-ai/deepseek-harness/commit/3e24087bfaeabe40b58ba2f7b936895b8f93fe27)
- [GitHub Discussion #243: Workflow Tool VM Escape via Host-Realm Functions](https://github.com/deepseek-ai/deepseek-harness/discussions/243)
- [GitHub Discussion #451: VM Sandbox Escapes + Unauthenticated /api RPC](https://github.com/deepseek-ai/deepseek-harness/discussions/451)
- [GitHub Discussion #817: Security Audit Report (7 Additional Findings)](https://github.com/deepseek-ai/deepseek-harness/discussions/817)
- [Rye Security Review: DeepSeek Harness Sandbox Network Scope](https://rye.ai/blog/deepseek-harness-sandbox-network-scope/)
- [arXiv:2608.16393 — Security Assessment of DeepSeek Harness with A.I.G (Indirect Prompt Injection)](https://arxiv.org/abs/2608.16393)
- [DeepSeek Harness Sandbox Architecture Documentation](https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/sandbox/sandbox-local/README.md)
- [Tencent AI-Infra-Guard: DeepSeek Harness Security Assessment](https://github.com/Tencent/AI-Infra-Guard)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2412