Evidence record / deepseek-harness
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundary
The Web cookie signing key crosses the same-user agent and operator boundary. The in-window disclosure prompts a narrower assessment of the existing login. A same-user confined command that can read the credential file and reach the local API has cookie signing material capable of impersonating an operator. Owner-only file permissions distinguish users, not that command from the harness. The authenticated operator can change permission presets and use the OS-user terminal. This is a static trust-path conclusion, not a new CVE, proof of remote pre-auth access, or proof every prompt injection succeeds.
Channel: preview-or-beta; static trust path at both current heads, not a newly introduced implementation. Half: defect. Date: 2026-10-02 (disclosure lead); source checked at rc.2 and alpha.2.
Operator consequence: Do not present loopback plus Workspace Write as independent control-plane protection. Evaluate in an outer disposable environment without valuable host credentials. To close the inner boundary, require source/release evidence that signing material is inaccessible to confined commands, followed by a controlled regression probe; TLS alone does not remove this path.
Receipt
- https://github.com/deepseek-ai/deepseek-harness/discussions/8678
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/client/connection/src/browser-auth.ts#L125-L177
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/credentials/credentials-local/src/index.ts#L675-L691
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/sandbox/sandbox-local/src/profiles.ts#L16-L35
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/client/connection/src/rpc-host.ts#L103-L112
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/interaction/permission-presets/src/index.ts#L252-L273
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundary
Profile citations
- deepseek-harness / claim / same-user-cookie-authority
Source links
Primary links, including exact changelog lines when available.
- public disclosure report2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundarygithub.com/deepseek-ai/deepseek-harness/discussions/8678tagged commit file2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundarydeepseek-ai/deepseek-harness / packages/client/connection/src/browser-auth.ts#L125-L177tagged commit file2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundarydeepseek-ai/deepseek-harness / packages/credentials/credentials-local/src/index.ts#L675-L691tagged commit file2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundarydeepseek-ai/deepseek-harness / packages/sandbox/sandbox-local/src/profiles.ts#L16-L35tagged commit file2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundarydeepseek-ai/deepseek-harness / packages/client/connection/src/rpc-host.ts#L103-L112tagged commit file2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundarydeepseek-ai/deepseek-harness / packages/interaction/permission-presets/src/index.ts#L252-L273
Versioned source: run artifact