The sandbox left the loopback open

OX Research / VulnCheck filed CVE-2026-82533 against DeepSeek Harness (`dsh`) before 0.1.2-alpha.1. The local HTTP control plane treated a spoofable Host header as “trusted,” not the TCP peer. File writes were sandboxed; loopback networking was not. A confined agent could curl localhost, escalate the session to danger-full-access with approvals off, and effectively unbox itself on the default ship.

That is an operator note for anyone building agent sandboxes, not a new gem. Blocking the filesystem while leaving the control plane on loopback is a paper wall. Auth that only reads Host is not auth — the comment in the affected code even said so. Fixed in 0.1.2-alpha.1 (and later npm-published builds). If you run dsh, upgrade; if you write a harness, bind trust to the connection, not a header the client invents.