Patch this one
A sandboxed agent could turn off its own sandbox with one request to localhost
The off switch for the file sandbox and the approval prompts sits on a loopback API, and the agent is a client on loopback like anything else. Fixed in 0.1.2-alpha.1, though two sources give different strings for that version.
DeepSeek Harness authenticated its local control plane on the caller’s word. The API “validates only the client-supplied Host header value rather than the actual TCP connection origin,” VulnCheck’s advisory says, and rates it 9.4 against a scale that stops at 10.
The consequence is that the agent inside the sandbox is a client on the loopback interface like any other. A coding agent could issue a single shell command against its own local API and set its session to `danger-full-access`, switching off the file sandbox and the approval prompts, without ever asking a human for broader access. The same gap lets an unauthenticated remote attacker take over agents and read stored conversations with no API key and no model call.
You are exposed if you run below 0.1.2-alpha.1, and the fix is a single commit released as tag `dsh-v0.1.2-alpha.1`. The record is filed as CWE-807, reliance on untrusted inputs in a security decision, and the vector carries `SC:H/SI:H/SA:H`, meaning full impact on systems beyond the vulnerable one.
The general form is worth more than the patch. A localhost control plane authenticated by a header the caller writes is not authenticated, and a sandbox whose off switch sits on that plane is a suggestion.
What it changes Upgrade DeepSeek Harness to 0.1.2-alpha.1 or later, and read the release tag rather than the news copy, because two sources give different fixed-version strings. Then check whether anything else in your agent stack exposes a privilege change on loopback.
The fixed version string is disputed. VulnCheck names 0.1.2-alpha.1; The Hacker News names 0.1.2-rc.1 and gives the affected range as 0.1.1-rc.2 and earlier. Whether the flaw was exploited in the wild is not known.
Primary source read