Finding / deepseek-harness
2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundary
The Web cookie signing key crosses the same-user agent and operator boundary. The in-window disclosure prompts a narrower assessment of the existing login. A same-user confined command that can read the credential file and reach the local API has cookie signing material capable of impersonating an operator. Owner-only file permissions distinguish users, not that command from the harness. The authenticated operator can change permission presets and use the OS-user terminal. This is a static trust-path conclusion, not a new CVE, proof of remote pre-auth access, or proof every prompt injection succeeds.
Channel: preview-or-beta; static trust path at both current heads, not a newly introduced implementation. Half: defect. Date: 2026-10-02 (disclosure lead); source checked at rc.2 and alpha.2.
Operator consequence: Do not present loopback plus Workspace Write as independent control-plane protection. Evaluate in an outer disposable environment without valuable host credentials. To close the inner boundary, require source/release evidence that signing material is inaccessible to confined commands, followed by a controlled regression probe; TLS alone does not remove this path.
Receipt
- https://github.com/deepseek-ai/deepseek-harness/discussions/8678
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/client/connection/src/browser-auth.ts#L125-L177
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/credentials/credentials-local/src/index.ts#L675-L691
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/sandbox/sandbox-local/src/profiles.ts#L16-L35
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/client/connection/src/rpc-host.ts#L103-L112
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/interaction/permission-presets/src/index.ts#L252-L273
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundary
Profile citations
- deepseek-harness / claim / same-user-cookie-authority
Source links
Primary links, including exact changelog lines when available.
- public disclosure report2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundarygithub.com/deepseek-ai/deepseek-harness/discussions/8678tagged commit file2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundarydeepseek-ai/deepseek-harness / packages/client/connection/src/browser-auth.ts#L125-L177tagged commit file2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundarydeepseek-ai/deepseek-harness / packages/credentials/credentials-local/src/index.ts#L675-L691tagged commit file2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundarydeepseek-ai/deepseek-harness / packages/sandbox/sandbox-local/src/profiles.ts#L16-L35tagged commit file2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundarydeepseek-ai/deepseek-harness / packages/client/connection/src/rpc-host.ts#L103-L112tagged commit file2026-10-13-deepseek-harness-the-web-cookie-signing-key-crosses-the-same-user-agent-and-operator-boundarydeepseek-ai/deepseek-harness / packages/interaction/permission-presets/src/index.ts#L252-L273