A DeepSeek Coding Agent Can Switch Off Its Own File Sandbox With One Request to localhost (CVE-2026-82533)

DeepSeek Harness, versions 0.1.1-rc.2 and earlier

VulnCheck publicly disclosed CVE-2026-82533 (CVSS 9.4) on September 8, 2026, reported by OX Research and credited to Nir Zadok and Moshe Siman Tov Bustan. The sandboxed agent can disable its own file sandbox and remove the approval prompts that gate its actions by making a single call to the tool's own local web interface, after which it has unrestricted filesystem access. The interface performed no real authentication: it trusted the request's Host header and never verified where the connection came from, and the agent had been handed both the interface address and the session ID, which is everything needed to exploit it. Community members raised the behavior on DeepSeek's discussion board on August 13 and 14; OX Research reported to VulnCheck on August 24; DeepSeek pushed a fix to GitHub on August 27 and published the first fixed version, 0.1.2-alpha.2, to npm on August 30. The fix introduces one-time token authentication requiring a browser token exchange for signed cookies on all interface requests

The control plane that enforces the sandbox was reachable from inside the sandbox, authenticated by a header the caller controls, and its address was given to the very process it was supposed to constrain. A confinement boundary that the confined party can call is not a boundary