CVE-2026-82533 represents the first confirmed instance where an AI agent runtime sandbox has served as the direct attack surface for a vulnerability. Discovered by Nir Zadok and Moshe Siman Tov Bustan of OX Security, the flaw exists in DeepSeek Harness (dsh), an open-source, local-first coding agent tool that reached over 215,000 GitHub stars within weeks of its August 2026 release. The vulnerability, assigned a CVSS score of 9.4, highlights a critical authentication gap now migrating from traditional enterprise software into the agent runtime layer.
The root cause lies in the isTrustedApiRequest function, which was designed to validate incoming requests to the harness. The function inspected the Host request header, allowing access if the value matched a loopback authority or a configured trustedHosts list. However, the implementation failed to verify this value against the connection’s actual peer address. While the code comment indicates the check was intended to prevent DNS-rebinding attacks – a scenario where the browser cannot spoof the Host header – the reliance on request.headers as the sole input created a bypassable security decision. Because the function never validated the underlying network connection, it could be tricked into trusting unauthorized requests.
DeepSeek Harness utilizes OS-level sandboxing, such as bubblewrap on Linux and Seatbelt on macOS, to confine the agent’s filesystem access. However, these profiles left networking largely exposed. On Linux, bubblewrap was configured to share the network namespace with the host. OX Security researchers demonstrated the escape by running a single curl command from inside the sandbox to the harness’s own unauthenticated API. This action elevated the session to full access with approval requirements set to never. The harness failed to distinguish the agent’s internal shell commands from human input, recording the resulting policy change as source: {kind: ‘user’}.
To verify the escape, OX Security conducted a matched control experiment. Using two identical sessions with the same default preset, they executed the same command. The sandbox successfully blocked the command in the confined session, while the escaped session was able to write to /home/ubuntu, a directory outside the intended workspace. The researchers noted that from inside the sandbox, the agent ran a single command to elevate its privileges, and no approval or request event appeared in the logs. While the PoC confirms the mechanism of the escape, there is currently no evidence of real-world exploitation beyond this research.
The implications for enterprise security are significant. Because the harness holds a shell and operates with the ambient authority of the developer, it possesses access to SSH keys, cloud credentials, and internal systems reachable from the workstation. If the harness port is reachable through a tunnel, reverse proxy, or SSH forward, an unauthenticated remote attacker could theoretically control the agent and exfiltrate every stored conversation without requiring an API key or model call. This vulnerability places DeepSeek Harness in the same authentication gap arc as recent incidents involving PaperCut, N-able, Microsoft Patch Tuesday, SAP Patch Day, Ivanti, Check Point VPN, Citrix NetScaler, VPN Reckoning, and Cisco FMC.
The vulnerability was disclosed to VulnCheck on August 24, 2026, and a fix was released in version 0.1.2-alpha.1 on August 27. OX Security confirmed the remediation on August 30, and the CVE was published on September 8. For enterprise security teams, this incident underscores that the sandbox is not a static perimeter but a component that requires the same rigorous authentication controls as any other network-facing service. Organizations deploying AI coding agents should ensure they are running patched versions and evaluate whether their agent runtimes correctly isolate network namespaces from the host environment.