Loading story…
A critical vulnerability, CVE-2026-82533, in DeepSeek Harness allows attacker-influenced AI coding agents to bypass the tool’s local control-plane authentication and switch their own sessions to danger-full-access. The HTTP API trusted a client-supplied Host header instead of validating the TCP peer, enabling a sandboxed agent to reach the loopback interface, disable file-write restrictions and approval prompts, and execute privileged commands without credentials, user approval, configuration changes, or external network exposure.
The flaw affects DeepSeek Harness 0.1.1-rc.2 and earlier. It can also expose stored conversations and session logs; remote attackers would require an existing port forward, tunnel, or proxy because the CLI does not bind externally by default. DeepSeek addressed the issue by adding one-time-token authentication, with fixed releases reported from 0.1.2-alpha.1 onward; organizations should update to a current patched release and review local API exposure, tunnels, proxies, and potentially compromised session data.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
VulnCheck published CVE-2026-82533 for the DeepSeek Harness Host-header authentication bypass, assigning it a CVSS 4.0 score of 9.4. The flaw affects versions 0.1.1-rc.2 and earlier and can enable unauthenticated agent control, unconfined execution, and stored-conversation access when the control API is reachable.
The third-party Windows desktop build moved from the affected release to fixed DeepSeek Harness 0.1.3-alpha.1.
OX Research retested DeepSeek Harness 0.1.2-alpha.1 and confirmed that CVE-2026-82533 had been remediated.
DeepSeek Harness 0.1.2-alpha.2 was published to npm as the first npm release containing the authentication fix.
DeepSeek pushed a fix for the flaw to GitHub in DeepSeek Harness 0.1.2-alpha.1. The remediation added one-time-token authentication for the local interface, although this alpha version was not published to npm.
OX Research disclosed the DeepSeek Harness authentication-bypass and sandbox-escape flaw to VulnCheck, acting as CNA.
A second developer publicly described the DeepSeek Harness local-interface sandbox escape on DeepSeek's discussion board.
A developer publicly described a local-interface sandbox escape in DeepSeek Harness on DeepSeek's discussion board, before a CVE was assigned.
A third-party Windows desktop build reportedly pinned the affected DeepSeek Harness 0.1.1-rc.2 release in late August.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourceox.security
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities in **OpenHarness** exposed administrative functionality to remote users through the platform’s gateway and channel layers. `CVE-2026-40502` affects versions prior to commit `dd1d235` and stems from insufficient separation between local-only and remote-safe commands in the gateway handler, allowing remote gateway users with chat access to invoke sensitive administrative actions such as changing permission modes on a running instance without operator approval. The issue is classified as `CWE-862` and carries a CVSS v3.1 score vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. A second flaw, `CVE-2026-6819`, affects HKUDS OpenHarness prior to the fix delivered in pull request `#156` and later release `v0.1.7`, exposing plugin lifecycle commands including `/plugin install`, `/plugin enable`, `/plugin disable`, and `/reload-plugins` to remote senders by default. An attacker who gains access through the channel layer could use the weakness to install or activate untrusted plugins and alter plugin trust state remotely, creating a path to full compromise of confidentiality, integrity, and availability. The vulnerability is tracked as `CWE-276` with CVSS v3.1 vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`.
Jun 29, 2026
Research from Novee Security found that default AI agent harnesses from major vendors could be abused to exfiltrate secrets, bypass trust boundaries, and chain individually approved actions into harmful outcomes. Elad Meged reported multiple issues affecting Anthropic, Google, and OpenAI tooling, arguing that the root problem lies in architectural trust decisions, approval logic, and cross-stage handoffs rather than prompt injection alone. One Google Gemini CLI issue was tracked as **`GHSA-wpqr-6v78-jr5g`** with a **CVSS 10.0** rating, while weaknesses were also identified in Anthropic's Claude Code Action and OpenAI's Codex CLI sandbox. The findings showed how controls can fail when agent components such as tools, memory, prompts, and execution environments trust each other too broadly. Researchers said Google's agent could be pushed into a supply-chain-style attack that wrote to its own GitHub repository, illustrating how safe-looking steps can combine into exploitable workflows. Vendors have added mitigations and fixes, but the repeated pattern across products points to a broader industry problem for organizations deploying autonomous agents on untrusted input, especially where human review is limited or absent.
Jul 31, 2026
Researchers disclosed multiple vulnerabilities in enterprise AI agent frameworks that allowed attackers to bypass model authorization, trigger tools directly, and in some cases achieve **remote code execution**. Check Point reported 11 flaws across **LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK**, spanning insecure deserialization, **SSRF**, path traversal, and use-after-free. One critical issue in Microsoft Agent Framework let untrusted state data reach insecure checkpoint deserialization, enabling RCE; Microsoft fixed the bug and said no `CVE` was assigned because the product was not generally available. A separate disclosure described a cross-platform pattern dubbed **CoreBreak**, where execution layers in **Amazon Bedrock AgentCore, Google ADK, and Vercel AI SDK harnesses** accepted tool-call-shaped data without confirming that a legitimate model turn had authorized the action. AWS assigned **`CVE-2026-18830`** and automatically patched the managed service, Google fixed **`CVE-2026-18236`** in ADK for Python version **2.5.0**, and Vercel patched **`@ai-sdk/harness-codex` 1.0.29** and **`@ai-sdk/harness-opencode` 1.0.28**. Researchers said the findings show that the main risk lies in insecure agent orchestration and tool-execution logic, not prompt injection alone, with Google ADK also exposed to abuse that could write and run malicious Python code and leak API keys or cloud service account credentials.
Aug 6, 2026