DeepSeek Harness: any local process could drive the agent's tools
The web interface of DeepSeek's agent harness accepted RPC calls from any local process, with no authentication at all.
· VulnCheck · Research by Opr4
DeepSeek Harness left its local web control plane unauthenticated, so any process on the machine could start a session, run the agent's bash and filesystem tools, and answer the human approval prompts itself.
01What happened
VulnCheck disclosed a missing-authentication flaw in DeepSeek Harness, DeepSeek AI's open-source agent harness, on 4 November 2026, crediting the researcher Opr4. The harness serves a web interface on the loopback address when started with the dsh web command.
02How it works
The HTTP and WebSocket RPC control plane behind that web interface checked no credentials. Any local process, including one running as a different operating system user, could call session methods such as session.create and session.prompt, then use the agent's bash and filesystem tools with the victim's configured model credentials. The same ungated event stream broadcast the rpcId, approvalId and sessionId values needed to answer a pending tool-approval prompt through POST /api/respond, and it exposed live session traffic and logs.
03Who is affected
Developers running the dsh web interface from a version VulnCheck lists as earlier than 0.1.2-alpha.2. Exposure requires an attacker to already run code on the same machine, such as a malicious dependency install script or a second account on a shared host. DeepSeek describes the project as a developer preview.
04What to do
Update DeepSeek Harness to the 0.1.2-alpha.2 release or later, which adds a host and origin fence plus browser token authentication to the web API. Rotate any model provider keys the harness held while an untrusted process could have reached it.
Sources 4 links, all fetched
- 1vulncheck.comVulnCheck Advisory
- 2github.comGitHub Advisory
- 3github.comFix Commit
- 4github.comFixed Release