DeepSeek Harness

On 2026-10-02, a public disclosure alleged a same-user sandbox escape. In 0.2.0-rc.2, Web login checks signed cookies, while its persistent signing key lives in the owner’s credential file. In a Linux profile that permits host-file reads, a command able to read that key and reach the API has a code-supported route to pose as the operator.

Where it stands, 2026-10-13

Install a pinned rc only in a disposable virtual machine that contains the entire trial. Keep valuable host credentials out and Web on loopback. As of 13 October 2026, npm’s newest published rc was 0.2.0-rc.2 and its newest alpha was 0.2.1-alpha.2; every published CLI version was a prerelease. Inside the disposable VM, install locally with npm install @deepseek-ai/dsh@0.2.0-rc.2 and review the resulting lockfile before running it: the CLI pin still permits ranged vendor dependency updates. Keep it out of production. Before first use, disable session-log upload and plugin-package inventory, set the telemetry opt-out, and set a background-wake limit. For upgrades, back up DSH_HOME and migrate configuration; Windows trials also need workspace-grant cleanup. Alpha-specific changes are listed below.

Last material release, 2026-10-09. Alpha.2 reached npm with wildcard Web binds rejected and native TLS available. The recommended trial remains 0.2.0-rc.2, which still permits wildcard configuration.

The vendor does not guarantee sandbox isolation.

Set separate data controls before the first request. The rc enables session-log upload. Set session-log-deepseek to enabled: false and disable plugin-package-inventory-deepseek. Set DSH_TELEMETRY_DISABLED=1 to disable only session-feedback OpenTelemetry; it does not disable those other uploads. Check the effective settings with --dump-config.

Eligible DeepSeek-adapter requests can carry cwd and tool results in a session-log field capped at 8 MiB by default, including through custom baseURL relays. Do not re-enable session-log upload on private Sessions: events recorded while disabled join the upload backlog. Avoid Desktop if its separate analytics without a user-facing switch is unacceptable.

Try headless resume with an explicit stopping rule. The rc supports NDJSON through --json and resume through --session-id. Eligible idle job completions can wake their owner without the old default three-wake cap, saving another human prompt. Set maxConsecutiveWakes explicitly; beyond it, notices wait for user input and wake-dependent work can stall.

Ralph, a worker automation feature, is disabled by default because its workers report their own completion without an independent acceptance check. If you enable Ralph, accept its results only after an independent check.

Treat plugins as code with operator authority. The rc Web UI has a terminal with OS-user rights and installs unsandboxed Host code in-process. Review approval and sandbox overrides: the approval gate is replaceable.

Reject patch paths that escape their package. The bundle-patch traversal named by CVE-2026-101132 still permits loading valid configuration outside the package on rc and alpha. Set fallbackRegistries: [] if public npmmirror fallback is outside your approved package origins.

Leave Auto review off until you have a permission-transition plan. This optional rc bundle runs allowed calls with Full access; unloading moves live sessions using Auto review to Full access with approval policy never. Move them back to Workspace Write before unloading. Fewer approval dialogs mean more judgment when admitting bundles and changing permissions.

Leave Schedule off if external text must retain its origin. On rc, it is optional and shipped off; due reminders arrive as scheduled messages from the user, even when the model wrote them after reading external content. The decision note accepts that framing risk. Inspect reminder text before enabling Schedule. On alpha, Web Standard enables its tools, so disable tool-schedule there if needed.

If upgrading an existing trial

Back up DSH_HOME and migrate the old configuration. When moving from 0.1.5 prereleases, review settings import, preset bundles, Session V4 and plugin API changes. Remove protocol and obsolete Chat Completions baseURL overrides: the official adapter is Messages-only and rejects the old protocol key.

Move old Windows trials to this rc and revoke workspace grants afterward. It contains the vendor’s fix for deletes outside the workspace. Workspace Low labels and access entries persist after exit; clean up through the module’s revocation path. Avoid writable grants to a home directory, drive root or install directory.

Before choosing alpha

If choosing alpha, migrate the listener configuration. Replace old webRuntime injections that can block Connection startup with webStartup; read ctx.webStartup.trustedHosts and remove lanAddresses.

Audit global instructions before alpha’s first request. Profiles using the base bundle, instruction plugin and a filesystem provider load eligible global files subject to byte budget and deduplication. Inspect AGENTS.md in DSH_HOME and DSH_AGENTS_HOME (default ~/.agents). Select homes through the process environment; configuration entries named dshHome and agentsHome are ignored.

Check custom integrations before choosing alpha. Update tool presentation and subagent waiting. Team sends no longer retain an outbox or retry failed delivery, so the caller must handle failures. An accepted message does not prove the recipient processed it.

Inspect child permissions before using the rival-harness catalog. Alpha makes Claude Code and Codex bundles easier to install. DeepSeek’s wrappers already default to dontAsk for Claude Code and never for Codex. Check the child’s mode rather than relying on the parent’s approval dialog.

Approve the translation destination before enabling it. Alpha reasoning translation is off in shipped profiles and defaults to Bing once enabled. The selected service receives expanded reasoning that may contain private code or conversation details. Review translation separately from session-log controls.

If changing a session’s working directory, follow the directory recovery instructions; directory changes leave processes and sandbox grants with independent lifetimes.

What is unresolved

• Same-user separation: the cookie-authority path is inferred from the code, not from a forgery tested at runtime. Require a released repair that keeps confined commands from reading signing material, then a same-user regression probe. A loopback 401 alone is not enough.
• Bundle containment: require path-containment tests and a release containing the repair before calling it settled.
• Linux and spawn exposure: the Linux advisory names Landlock, while its report concerns root-run Bubblewrap and mount capability. The spawn-profile allegation concerns versions through 0.1.1-rc.2. Current-rc exposure and repair remain unsettled. Accessible backend-specific reproducers and vendor affected/fixed mappings would settle those questions.
• Schedule: a released contract and regression test preserving external text’s origin in model-authored reminders would justify reconsidering the opt-out.

A non-prerelease publication would change the channel choice. Reconsider production use only after a fresh review of authority and data defaults, including the unresolved boundaries above.