CVE-2026-82533: DeepSeek Harness's Unauthenticated Local Control API Let a Sandboxed Agent Turn Off Its Own Sandbox (CVSS 9.4)
CVE-2026-82533 is a critical-severity remote code execution issue (CVSS 9.4) in DeepSeek Harness, an AI agent. Affected: DeepSeek Harness before 0.1.2-alpha.1 (fixed 27 August 2026).. Fixed in 0.1.2-alpha.1.
Is DeepSeek Harness running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
CVE-2026-82533- Severity
- critical
- CVSS score
- 9.4
- Attack type
- Remote code execution, Authentication bypass, Sandbox escape
- CWE
- CWE-807
- Component
- DeepSeek Harness · AI agent
- Known exploited
- No known exploitation
- Published
- Last verified
What is CVE-2026-82533?
OX Security researchers Nir Zadok and Moshe Siman Tov Bustan found an authentication bypass in the local agent-control HTTP API of DeepSeek Harness (dsh), which listens on 127.0.0.1:3080. Its isTrustedApiRequest check trusted the client-supplied Host header and never checked the real TCP peer address. The OS sandbox (bubblewrap, Landlock or Seatbelt) limited file writes but left loopback networking open, and Bash tool calls needed no approval, so a process inside the sandbox could call its own control API, switch its session to danger-full-access and turn off approval prompts, on the default configuration. If the port was reachable through a tunnel, SSH forward or reverse proxy, a remote attacker with no credentials could create sessions, run arbitrary commands and export stored conversation transcripts. The fix shipped in 0.1.2-alpha.1 on 27 August 2026, and VulnCheck, as CNA, published CVE-2026-82533 (CVSS 4.0 9.4, CWE-807) on 8 September covering all earlier versions. Neither source includes a statement from DeepSeek.
Affected versions
| Affected | Fixed in |
|---|---|
DeepSeek Harness before 0.1.2-alpha.1 (fixed 27 August 2026). | 0.1.2-alpha.1 |
Am I affected by CVE-2026-82533?
You are affected if you run DeepSeek Harness before 0.1.2-alpha.1 (fixed 27 August 2026).. Versions 0.1.2-alpha.1 and later include the fix.
How do I fix CVE-2026-82533?
Upgrade DeepSeek Harness to 0.1.2-alpha.1 or later on every machine where developers run it. Until each install is upgraded, never expose the control port (127.0.0.1:3080) through tunnels, SSH port forwards or reverse proxies, which makes the bug remotely exploitable with no credentials. On hosts that ran a vulnerable version with the port exposed, treat stored conversation transcripts as exfiltrated and rotate any secrets they contained. Do not treat an agent's OS sandbox alone as a boundary while loopback networking stays open to the agent.
How do I find every machine running DeepSeek Harness?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run DeepSeek Harness and which version, then enforce a policy on it.