OX Research discloses DeepSeek Harness sandbox escape vulnerability CVE-2026-82533

OX Research discovered a critical vulnerability in DeepSeek's open-source coding agent framework DeepSeek Harness (dsh), where a sandboxed agent can remove its own sandbox restrictions with a single shell command. The vulnerability is assigned CVE-2026-82533 with a CVSS score of 9.4. The cause is that Harness exposes an unauthenticated agent control API on a local HTTP port, trusting requests based solely on the client-supplied Host header without verifying the actual peer address of the connection; additionally, its OS sandbox (bubblewrap, Landlock, or Seatbelt) only restricts file writes but retains loopback networking, and ordinary bash calls do not require approval. A second attack path is that as long as the port is reachable (via tunneling, reverse proxy, SSH forwarding, editor port forwarding, etc.), an unauthenticated remote attacker can directly control the agent and export all stored conversations without an API key.