On September 8, 2026, VulnCheck published an advisory for CVE-2026-82533, a critical authentication bypass in DeepSeek Harness, a tool for running AI agents. The advisory says the tool granted unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header. Because the check trusted what the request claimed about itself rather than where the connection actually came from, anything able to send an HTTP request to that local port could pass as trusted. VulnCheck scored it 9.4 under CVSS and classified it as CWE-807, Reliance on Untrusted Inputs in a Security Decision. Versions before 0.1.2-alpha.1 are affected; 0.1.2-alpha.1 fixes it. The flaw was credited to Nir Zadok and Moshe Siman Tov Bustan of OX Security.
The impact listed in the advisory is what makes it more than a routine web bug. A confined process - including the agent the harness is supposed to be confining - could use the API to escape its sandbox, escalate its own execution privileges and disable approval prompts. If the API port was reachable from outside the machine, a remote attacker could create sessions, run commands and read stored conversation transcripts without any credential.
This is the uncomfortable shape of agent security in 2026. A sandbox is only as strong as the control plane that can turn it off, and here the control plane sat on the same machine as the thing it constrained, guarded by a header the constrained process could set. An agent does not need to be malicious to trip it: text an attacker plants in a file or web page the agent reads is enough to prompt the one shell command that removes the guardrails.
The fix is simple and the tool is young, with pre-release version numbers. The broader lesson is not: any agent harness that exposes a local management API needs to assume the agent itself is a hostile client of that API, and should authenticate accordingly.