DeepSeek's agent tool let the agent switch off its own sandbox
Two separate failures at the same lab in one week, and both are about the same thing: what a model provider promises a developer it will keep.
DeepSeek's local coding-agent tool let a sandboxed agent turn off its own file sandbox with a single command and no approval prompt. The flaw, now CVE-2026-82533 with a CVSS score of 9.4, sits in DeepSeek Harness, the open-source tool the lab released in August to run coding agents on a developer's own machine; the repository passed 216,000 GitHub stars by September 9, which counts bookmarks rather than installs. Harness runs an agent's commands inside an operating-system sandbox so that an agent chewing through untrusted files cannot write outside its workspace. The problem was the tool's own local control API: it decided whether a caller was allowed by reading a Host header the caller supplied, instead of checking where the connection actually came from. The sandbox confines file writes but leaves the network alone, so loopback was reachable from inside — and Harness hands the agent's shell both the interface address and the current session ID, meaning the agent never has to go looking. One call switched the session to a full-access mode, and subsequent commands ran unconstrained. OX Research confirmed the boundary itself was working by running two identical sessions and letting only one make the call. There is a second path: if a user forwards that port through a tunnel, an SSH forward or an editor, an outside attacker can drive the agent and download every stored conversation without a key. DeepSeek patched on August 27, but the release named as fixed never reached the npm registry where the project's own instructions send users; the first published version carrying authentication was a later one. Developers had described the same escape in GitHub discussions on August 13 and 14, before any CVE existed, against a project that had — and still has — no security policy file. The lesson generalises past DeepSeek: a containment control the confined process can itself address is not a control. We explained the category in AI 101 — What is a sandbox escape?.
DeepSeek withdrew the forced retirement of V4 Pro less than 48 hours after announcing it. On September 9 a member of its Harness team posted that V4.1 Flash beat V4 Pro on performance, cost, speed and total latency, so every V4 Pro request would route to Flash and bill at Flash prices — with the switch effective roughly a day later and no parallel run. Developers found out largely from the comment section of that post, which drew more than 700,000 views. Launch day brought a second email moving the cutoff to noon Beijing time on September 14, while the previous-generation Flash rows were pulled immediately; V4 Pro's generally available build had shipped on August 13, under a month earlier. On September 11 the lab reversed course, posting that it would continue serving V4 Pro after September 14 with billing unchanged. The complaints were never about wanting the old model back — they were about being migrated without a buffer: prompt tuning, output-format drift and tool-call ordering break live systems in ways chat never shows, and researchers pointed out that pulling a pinned endpoint makes published experiments unreproducible. Western labs document minimum deprecation notice periods for exactly this reason. We covered the original four-day cutoff in DeepSeek V4.1 Flash ships — and retires V4 Pro on Sunday.
What to watch: whether Harness publishes a security policy and a private disclosure channel, and whether DeepSeek replaces its pricing-page footnotes with a versioned deprecation policy before the next model swap.
Is a free model with unpredictable behaviour worth more to your stack than a paid one with a two-week migration window? Tell us in the comments.
