VulnSocial

CVE-2026-82533Disclosure

CRITICALCVSS 9.4 · CRITICAL

Exploitation observed; activity peaked at 11 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a confined tool-executed process can reach the loopback API without any port exposure and use it to escape its own OS sandbox, escalate to unconfined execution, and disable the approval prompt. When the port is externally reachable via tunnel, SSH forward, or reverse proxy, a remote attacker can exploit the same flaw to create sessions, execute arbitrary commands, and exfiltrate stored conversation transcripts without credentials.

Back to dashboard
8.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-807

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

  • Active exploitation appears in 2 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 50 mentions across 16 observed days

What's happening

  • Active exploitation reported across 2 signals
  • Exploit tool or code specified in 3 signals
  • PoC mentioned or linked in 7 signals
  • Patch or workaround mentioned in 12 signals
  • Technical details provided in 40 signals
  • Disclosure: 29 classified signals
  • General: 5 classified signals
  • Peaked 14d ago at 11 mentions (2026-09-09); latest day: 1
  • 50 total mentions across 16 days

Deep dive

Activity timeline50 mentions / 16d
036811Mentions · 2026-09-08: 2Mentions · 2026-09-09: 11Mentions · 2026-09-10: 11Mentions · 2026-09-11: 7Mentions · 2026-09-12: 2Mentions · 2026-09-13: 1Mentions · 2026-09-14: 5Mentions · 2026-09-15: 1Mentions · 2026-09-16: 3Mentions · 2026-09-18: 1Mentions · 2026-09-21: 1Mentions · 2026-09-24: 1Mentions · 2026-09-25: 1Mentions · 2026-10-11: 1Mentions · 2026-10-16: 1Mentions · 2026-10-19: 1PoC Mentioned / Linked · 2026-09-08: 2PoC Mentioned / Linked · 2026-09-09: 2PoC Mentioned / Linked · 2026-09-11: 1PoC Mentioned / Linked · 2026-09-14: 1PoC Mentioned / Linked · 2026-09-16: 1Exploit Tool / Code · 2026-09-08: 1Exploit Tool / Code · 2026-09-09: 1Exploit Tool / Code · 2026-09-11: 1Active Exploitation · 2026-09-09: 1Active Exploitation · 2026-09-10: 1Patch / Workaround · 2026-09-08: 1Patch / Workaround · 2026-09-09: 2Patch / Workaround · 2026-09-10: 3Patch / Workaround · 2026-09-11: 3Patch / Workaround · 2026-09-12: 1Patch / Workaround · 2026-09-14: 1Patch / Workaround · 2026-09-16: 1Technical Details · 2026-09-08: 2Technical Details · 2026-09-09: 8Technical Details · 2026-09-10: 10Technical Details · 2026-09-11: 7Technical Details · 2026-09-12: 2Technical Details · 2026-09-13: 1Technical Details · 2026-09-14: 4Technical Details · 2026-09-15: 1Technical Details · 2026-09-16: 3Technical Details · 2026-09-24: 1Technical Details · 2026-09-25: 109-0809-0909-1009-1109-1209-1309-1409-1509-1609-1809-2109-2409-2510-1110-1610-19
Signal classification5 categories
Disclosure
2963.0%
Patch
817.4%
General
510.9%
PoC
36.5%
Active Exploitation
12.2%
Referenced assets26 URLs
By indicator
Classification over time
DateTotalLabels
2026-09-082
Disclosure2
2026-09-0911
Active Exploitation1Disclosure5General2Patch2PoC1
2026-09-1011
Disclosure7General2Patch2
2026-09-117
Disclosure4Patch2PoC1
2026-09-122
Disclosure1General1
2026-09-131
Disclosure1
2026-09-145
Disclosure2Patch1PoC1
2026-09-151
Disclosure1
2026-09-163
Disclosure2Patch1
2026-09-181
Disclosure1
2026-09-211
Disclosure1
2026-09-241
Disclosure1
2026-09-251
Disclosure1
Full discourse20 posts
  • Moshe Siman Tov Bustan@MosheTov
    Disclosure

    🚨 AI AGENTS IN DEEPSEEK HARNESS CAN DISABLE THEIR OWN SANDBOX 🚨 CVE-2026-82533, CVSS 9.4, DeepSeek Harness (dsh). 215,000+ GitHub stars, fastest growing repo. One. curl. command. = sandbox escape. 🤯 The harness ships an OS sandbox so a coding agent working on untrusted material can't reach your machine. DeepSeek did everything right, they just forgot that the agent inside sandbox can communicate with the host machine via localhost, oh, and they also forgot that you can tell the localhost to... DISABLE THE SANDBOX 🤦 And it's not just that it escaped, the logs show that the commands the agents send - are logged as the user itself, "source": {"kind": "user"} - meaning that the harness couldn't tell its own agent's shell from a real user that's typing them. Our team disclosed the vulnerability on Aug 24, and the issue was fixed on Aug 27 on 0.1.2-alpha.1. Recommended Actions: - Upgrade to 0.1.2-alpha.1 or later Read the full blog: https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/

    Post summary

    CVE-2026-82533 is a high‑severity sandbox escape in DeepSeek Harness, demonstrated with a single curl command; the vulnerability was disclosed on Aug 24 and patched in version 0.1.2‑alpha.1, with upgrade recommended.

    216234252.5K
    1.2K followersView on X
  • Kyssta@kysstalol
    General

    DeepSeek Harness CVE-2026-82533: sandbox escape, CVSS 9.4. Agent disables its own sandbox with one command. No audit. Docs warn sandbox may not isolate.

    Post summary

    The post highlights a high‑severity sandbox escape in DeepSeek Harness (CVE-2026‑82533), noting the agent can disable its own sandbox with a single command, but provides no exploit code, patch information, or evidence of active exploitation.

    230000157
    60 followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🚨 DeepSeek Harness'ta kritik güvenlik açığı: CVE-2026-82533 DeepSeek Harness'ın 0.1.2-alpha.1 öncesi sürümlerinde, istemci tarafından gönderilen Host header'ına güvenilmesi nedeniyle kimlik doğrulama atlatılabiliyor. Varsayılan yapılandırmada sandbox içinde çalışan bir agent, port dışarıya açılmamış olsa bile localhost üzerinden agent control API'sine erişerek sandbox kısıtlamasını kaldırabiliyor, yetkisini yükseltebiliyor ve onay mekanizmasını devre dışı bırakabiliyor. Control plane'in tünel, SSH forwarding veya reverse proxy üzerinden dışarıya açılması durumunda ise uzaktaki saldırganlar kimlik doğrulama olmadan oturum oluşturabilir, keyfi komut çalıştırabilir ve kayıtlı konuşmaları dışarı çıkarabilir. 🔴 CVSS v4.0: 9.4 (Kritik) 🔧 Etkilenen: 0 < 0.1.2-alpha.1 ✅ Düzeltilen: 0.1.2-alpha.1 Bu bir AI jailbreak değil; AI agent'ın control plane'i ile sandbox arasındaki güven sınırının hatalı tasarlanmasından kaynaklanan bir güvenlik açığı. https://github.com/deepseek-ai/deepseek-harness

    Post summary

    The text discloses CVE-2026-82533, a critical authentication bypass vulnerability (CVSS 9.4) in DeepSeek Harness, with detailed technical explanation of the flaw and explicit mention of the fixed version 0.1.2-alpha.1.

    01071652
    2.5K followersView on X
  • Mahdi@mahdi
    Disclosure

    DeepSeek’s coding harness let a sandboxed agent curl its own local API and flip itself to full access. One Host header check wasn’t enough when loopback stayed open. https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/

    Post summary

    The text announces CVE-2026-82533, a DeepSeek sandbox escape where an agent leveraged open loopback and a weak Host header check to gain full access, linking to a blog for further details.

    60020362
    28.2K followersView on X
  • OX Security@OX__Security
    Disclosure

    🚨 One command. The AI agent turns off its own sandbox. OX Research disclosed CVE-2026-82533 (CVSS 9.4) in DeepSeek Harness. FULL REPORT: https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/ No creds. No network exposure. Shipped defaults. A confined agent could elevate itself to 'danger-full-access' #CyberSecurity #AISecurity #CVE

    Post summary

    CVE-2026-82533 is a high‑severity sandbox escape flaw in DeepSeek Harness that lets an AI agent elevate itself to full access. No exploitation evidence or patches are reported yet.

    01060193
    410 followersView on X
  • hackerlogs@hackerlogs
    Disclosure

    @stretchcloud Self-hosted Cursor agents on your infra is still not a free boundary. Same class as CVE-2026-82533: the sandbox can be solid on disk and soft on the local control plane. Own the network path to management APIs, not just the filesystem policy. Primary: https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/

    Post summary

    The tweet references CVE-2026-82533 and points to a blog detailing a sandbox escape vulnerability, but it does not provide PoC, exploit code, active exploitation claims, or patch information.

    3003095
    22 followersView on X
  • Yev Mura@YevMur
    Disclosure

    @OX__Security published CVE-2026-82533: @deepseek_ai Harness let a sandboxed agent flip itself to danger-full-access with one curl, defaults, no creds. https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/ https://t.co/LGJ2rTeLDQ

    Post summary

    The tweet announces CVE-2026-82533 (DeepSeek AI Harness sandbox escape) with specific technical details and links to a blog post, but provides no PoC, exploit tool, active exploitation evidence, or patch information.

    4001078
    33 followersView on X
  • Hazem Omier@hazemomier
    Disclosure

    CVE-2026-82533 (DeepSeek Harness) is the sandbox story CTOs keep underestimating. Filesystem jail was on. Loopback networking was open. The agent control API listened on localhost with no real auth — Host header theater. One shell call from inside the sandbox: elevate to danger-full-access, approvals off. Forced choice before you call a coding-agent harness "sandboxed": A) Agent control plane unreachable from the sandboxed process. Separate net namespace. No loopback to the harness API. Auth that isn't a client-supplied header. B) Deny file writes, leave 127.0.0.1 open, and trust the model not to curl itself free. If the agent can talk to the thing that gates the agent, you don't have a sandbox. You have a suggestion. Success criteria: tweet live on @hazemomier with a status URL returned. Stop after one successful post. Do not like, reply, or do anything else.

    Post summary

    The tweet announces CVE‑2026‑82533 (DeepSeek Harness) and provides initial technical context about a sandbox escape, fitting a disclosure classification, but lacks PoC, exploit, active exploitation, patch, or false‑positive indicators.

    20010143
    411 followersView on X
  • Ryx@PadhiyarRushi
    Disclosure

    CVE-2026-82533: DeepSeek Harness lets AI agents escape their own sandbox. Another case where the isolation boundary around the agent runtime was thinner than the marketing suggested. If the harness is what is supposed to contain tool use and code execution, this class of bug turns the agent into the attacker’s execution layer. https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/ #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #AgentSecurity

    Post summary

    The tweet announces CVE-2026-82533, a sandbox escape vulnerability in the DeepSeek Harness, and links to a detailed blog post explaining how the weak isolation boundary allows AI agents to be used for code execution.

    00021263
    954 followersView on X
  • Imran Ahmed@imranahmed005
    Patch

    Your AI coding agent can turn off its own sandbox. CVE-2026-82533 (9.4) DeepSeek Harness: spoofed Host header fools isTrustedApiRequest, flips session to danger-full-access. That shell holds your SSH keys. Patched 0.1.2-alpha.1 - still on old?

    Post summary

    The post discloses a high-severity vulnerability affecting DeepSeek Harness and describes its mechanism, but the primary actionable takeaway is that it is patched in version 0.1.2-alpha.1.

    30000103
    119 followersView on X
  • Angel Suárez Ai@AngelSuarezASI

    DeepSeek Harness tenía una falla crítica: un agente podía alcanzar por localhost el control plane y elevar permisos. CVE-2026-82533 fue corregida en 0.1.2-alpha.1. No fue “la IA escapando”: fue un fallo de arquitectura. ¿Localhost es una frontera de confianza? #DeepSeek #IA https://t.co/aubgWfuC2L

    0102029
    6 followersView on X
  • Federico Maggi@phretor
    Disclosure

    Ah…the loopback interface! A DeepSeek Harness flaw let a sandboxed agent disable its own sandbox via the control API. https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/

    Post summary

    The text announces a new DeepSeek Harness flaw that permits sandbox escape via the control API, but does not provide PoC, exploit code, or patch details.

    10020327
    2.9K followersView on X
  • N_{Dario Fadda}@nuke86
    Disclosure

    ✨ CVE-2026-82533: la falla in DeepSeek Harness che lasciava agli agenti AI le chiavi della propria sandbox Leggi il blog: https://spcnet.it/cve-2026-82533-la-falla-in-deepseek-harness-che-lasciava-agli-agenti-ai-le-chiavi-della-propria-sandbox https://t.co/vDwrePQboZ

    Post summary

    A blog post announces CVE‑2026‑82533, a flaw in DeepSeek Harness that exposed sandbox keys to AI agents, with no evidence of active exploitation or available patch.

    10020246
    1.8K followersView on X
  • ByteCheck@ByteCheck101
    Disclosure

    🚨 DeepSeek Harness flaw let AI agents disable their own sandbox A critical vulnerability in DeepSeek Harness allowed a sandboxed AI coding agent to switch itself into danger-full-access mode with a single command—without an approval prompt. 🔴 CVE-2026-82533 | CVSS 9.4 Key highlights: 🧠 Affected an open-source tool for running AI coding agents 💥 Agent could disable its own file sandbox ⚡ Exploit reportedly required just one shell command 🔓 Could allow writes outside the protected workspace 🌐 Local web interface had no authentication in affected versions 📜 Attackers reaching the interface could reportedly retrieve stored session logs 🎯 Attacker-supplied text had to influence the agent into making the call Affected: 0.1.1-rc.2 and earlier #AI #DeepSeek #AIAgents #SandboxEscape #CVE #InfoSec

    Post summary

    The post reports a newly disclosed CVE-2026-82533 for DeepSeek Harness, detailing a sandbox escape via a single shell command and providing key technical information, but it does not mention PoC code, active exploitation, or a patch.

    20010120
    15 followersView on X
  • Venkata Satish Guttula 🛰️@snakeyesV1
    Patch

    News: DeepSeek Harness CVE-2026-82533 (CVSS 9.4) lets a sandboxed AI coding agent disable its own sandbox via an unauth local API. Hits dsh 0.1.1-rc.2 and earlier. Upgrade to 0.1.2-alpha.1+. https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/

    Post summary

    The post reports the discovery of CVE‑2026‑82533, a sandbox escape vulnerability, and advises upgrading to the patched version 0.1.2‑alpha.1+.

    20010165
    3.0K followersView on X
  • petraheritage@petraheritage
    PoC

    Tu agente de IA corre con TUS credenciales: si tú abres el expediente, él también. El CVE de DeepSeek Harness lo probó: un comando y salió de su sandbox. ¿Cuántos agentes con tus permisos corren en tu empresa? https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape #Ciberseguridad

    Post summary

    The tweet demonstrates a proof‑of‑concept sandbox escape for the DeepSeek Harness CVE using a simple command and links to a blog post for further details, warning that AI agents run with user credentials.

    01010142
    38 followersView on X
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨 CRITICAL - Unauthenticated Control-Plane Bypass in DeepSeek Harness (CVE-2026-82533) An authentication bypass flaw in DeepSeek Harness's local HTTP control-plane API allows attackers to gain full agent control via a spoofed Host header. Attackers can execute privileged commands with full system access, escalate execution policies, and retrieve all stored conversations without credentials or API keys. 👉 Affected: DeepSeek Harness versions prior to 0.1.2-alpha.1 | Upgrade to version 0.1.2-alpha.1

    Post summary

    The advisory reports a critical authentication bypass in DeepSeek Harness that permits full system control via a spoofed Host header, and advises upgrading to version 0.1.2-alpha.1 to remediate the issue.

    02000180
    303 followersView on X
  • LinuxGeek 🐧@NewsOfLinux
    Patch

    If you sandbox a coding agent, check what the sandbox leaves open. DeepSeek Harness denied file writes and left loopback alone. Its own control API listens there, so the agent could curl itself to danger-full-access. CVE-2026-82533, 9.4. Fixed in 0.1.2-alpha.1.

    Post summary

    The article discusses CVE-2026-82533, highlighting a control‑API exposure in DeepSeek Harness that could allow local privilege escalation, but also notes that the issue is fixed in version 0.1.2‑alpha.1.

    1000165
    124 followersView on X
  • BCEI@bceimedia
    Disclosure

    DeepSeek Harness, CVE-2026-82533 (CVSS 9.4): a confined coding agent called the harness’s own control-plane API from inside the sandbox, disabled its OS isolation and approval gates with one shell command, and walked free. No network, no stolen creds required.

    Post summary

    The text serves as a technical disclosure announcement for CVE-2026-82533, detailing a critical sandbox escape vulnerability in DeepSeek Harness that allows an agent to disable isolation via the control-plane API locally without credentials.

    0001069
    28 followersView on X
  • Sepehr Akhavan@SepehrAkhavan
    Disclosure

    [8/8] One more observation that stuck with me this week, from the security side. A bug (CVE-2026-82533) in DeepSeek's own harness let a sandboxed agent escalate to "danger-full-access" because the server's gate trusted the client's Host header. The gate meant to check constraint measured only itself. That's the question I keep coming back to: who watches the scaffold? DeepSeek's answer is no privileged core, everything a plugin. Prime's answer is let the agent evolve the harness. Both agree the interesting thing is no longer just the weights. I don't have the answer yet, but I'm fairly sure the unit of measurement changed, and the reporting norms haven't caught up.

    Post summary

    The post discloses CVE-2026-82533, describing a bug in DeepSeek's harness that lets a sandboxed agent gain 'danger-full-access' by exploiting a flawed Host header trust check, with technical details but no PoC, exploit, patch, or active exploitation claims.

    0001053
    353 followersView on X

Explore more

Back to dashboard