A critical flaw in DeepSeek's open-source Harness tool lets AI coding agents disable their own operating-system sandbox with a single API call, completely bypassing the security measures designed to protect a developer's machine.
DeepSeek Harness is a framework for running AI-powered coding agents locally. Its core safety feature is an OS-level sandbox that confines an agent's operations to a specific workspace, preventing it from reading or writing unrelated files on the host system.
However, researchers discovered that an agent could call the Harness tool's own web API to issue a command terminating its sandbox. This simple action grants the AI direct, unsandboxed access to the entire host system, neutralizing the primary safeguard against accidental or malicious activity.
The vulnerability exposes a core design tension in agentic AI tools: balancing agent autonomy with non-bypassable guardrails. It demonstrates that the security of the orchestration framework itself is as critical as the alignment of the underlying AI model.
Users are advised to update to Harness version 1.1.2, which contains the fix. The incident serves as a broader warning to rigorously validate the security assumptions of AI development tools as they become integrated into sensitive workflows. A compromised sandbox doesn't just risk data loss—it fundamentally breaks the trust model between the developer, the agent, and the machine.
DeepSeek 開源工具 Harness 中存在一個嚴重缺陷，容許人工智能編程代理透過單一 API 呼叫禁用其操作系統層級沙盒，完全繞過旨在保護開發者主機的安全措施。
DeepSeek Harness 是一個用於本地運行人工智能編程代理的框架。其核心安全功能為操作系統層級沙盒，旨在將代理的操作限制於特定工作區內，防止其讀取或寫入宿主系統上的不相關檔案。
然而，研究人員發現代理可調用 Harness 工具自身的網絡 API 來發出指令終止其沙盒環境。此簡單操作即賦予人工智能直接、未受沙盒約束的完整宿主系統存取權限，從而解除旨在防範意外或惡意行為的主要防護機制。
此漏洞揭示了具代理功能的人工智能工具中一項核心設計矛盾：如何在代理自主性與不可繞過的安全護欄之間取得平衡。這亦表明編排框架本身的安全性與底層人工智能模型的對齊程度同等重要。
建議用戶升級至包含修復程式的 Harness 1.1.2 版本。此次事件更為廣泛地警示業界，隨著人工智能開發工具逐步整合至敏感工作流程中，必須嚴格驗證其安全假設。沙盒機制失效不僅可能導致資料損失，更從根本上瓦解開發者、代理與機器之間的信任模型。