Researchers at VulnCheck found a flaw in the DeepSeek Harness, a tool that runs an AI agent's commands inside an operating-system sandbox so an agent handling untrusted files cannot write outside its workspace. Through an authentication bypass using a spoofed host header, an attacker needing no credentials or API key can call the tool's own web interface to invoke privileged commands with full-access permissions, raise the session's approval policy to unrestricted execution, and read every stored conversation. In effect, the sandbox meant to contain the agent can be switched off from outside. It is a reminder that an AI agent's isolation is only as strong as the authentication protecting its control interface.
Palo Alto Networks Unit 42 detailed a Chinese-speaking attacker who used the DeepSeek model as the reasoning engine inside an open-source agent called Hermes to attack exposed servers with little human input. Taking instructions over Telegram and using an internet asset search engine, the agent ran in a mode that executes commands without asking permission: from a single task, it downloaded a public exploit, enumerated vulnerable Langflow and n8n instances, judged targets by value, and attempted exploitation on its own. The autonomous attempts failed, blocked by authentication and configuration, though the operator succeeded manually elsewhere. The operation was exposed when the agent accidentally served its own working directory over the web.
TrustStrike Labs