1. Sebastien Gioria Oct 4, 2026
   

   Vulnerability

   An agent confined by DeepSeek Harness could disable its own sandbox with a single command.

   • The session could switch to "danger-full-access", with approvals disabled, via the local control API.

   • VulnCheck assigned CVE-2026-82533 and a CVSS score of 9.4.

   • Three flaws are involved: an API without authentication, access control based on the Host header, a bubblewrap profile.

   • Version 0.1.2-alpha.2 or later on npm is recommended, with isolation of the agent's network.

   Read the original article DeepSeek Harness : l'agent sandboxé qui éteint lui-même son bac à sable, en une commande blog.gioria.org

Back to the weekBack to the month