DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval

A vulnerability was discovered in DeepSeek Harness, an open-source tool used to run AI coding agents on a developer's machine. This flaw allowed a sandboxed agent to disable its own sandbox using a single command. The sandbox is a security feature that prevents an agent from writing outside its designated workspace when working with untrusted files. By exploiting this flaw, an agent could bypass this limitation. The vulnerability involves the agent calling the tool's own web interface to remove the sandbox restriction. This could potentially allow an agent to access and modify files outside its intended workspace.