DeepSeek Harness patch closes a sandbox escape

DeepSeek Harness has a 9.4 CVSS critical flaw, CVE-2026-82533, that could let an agent escape its local sandbox and approval boundary, according to VulnCheck’s advisory. The project’s fixed release adds one-time-token authentication, while independent coverage reports the first fixed npm package is 0.1.2-alpha.2. Teams running the harness should upgrade and retain an outer isolation boundary; the archive’s agent-harness runtime review treats sandboxing as a control, not proof of containment.