Affected Systems
DeepSeek Harness versions 0.1.1-rc.2 and earlier. The tool runs AI coding agents on developer machines. Fixed in version 0.1.2-alpha.2 (npm) and later. Third-party desktop wrappers may ship vulnerable versions independently.
Exploitation Status
Proof-of-concept demonstrated by OX Research. Exploitation requires attacker-supplied text that prompts the agent to invoke a single shell command targeting the local web interface. No reports of active exploitation in the wild.
Business Impact
Sandboxed AI agents processing untrusted files can write outside their intended workspace by disabling their own sandbox via an unauthenticated local API call. The agent runs under the user's account, so successful escape grants filesystem write access to all user-accessible locations. Network access and reads were already unconfined in default configuration. The local API also exposes all stored conversation logs without authentication. Risk is elevated in environments where developers use the tool on untrusted codebases or where the web interface is exposed via SSH tunnels, proxies, or port forwards.
Urgency
🟡 Within a week
Recommended Actions
- Upgrade DeepSeek Harness to version 0.1.2-alpha.2 or later (current release: 0.1.2-rc.1) via npm or GitHub.
- If using third-party desktop wrappers, verify the bundled harness version and update the wrapper to one shipping 0.1.2-alpha.2 or later.
- Remove any SSH tunnels, proxies, or port forwards that expose the DeepSeek Harness web interface (default local-only binding).
- If upgrade is not immediately possible, stop the web interface when not actively in use and avoid processing untrusted files with the agent.
- Review session logs for unexpected 'danger-full-access' mode changes or filesystem writes outside designated workspaces since August 21.