| Title | deepseek-ai deepseek-harness dsh-v0.1.0-rc.7 DeepSeek Harness `run_code` (Code Mode) executes model-written T |
|---|
| Description | DeepSeek Harness confines the agent's file effects through a kernel-grade sandbox seam (`ctx.sandbox`, implemented by `@deepseek-ai/dsh-sandbox-local` over bubblewrap / Landlock / Seatbelt on Linux/macOS). The two ordinary agent code paths both honor it: the bash tool runs through `@deepseek-ai/dsh-bash-sandbox`, which wraps every `bash -c` in `ctx.sandbox.confine(...)`, and the filesystem tools run through `@deepseek-ai/dsh-fs-sandbox`, which re-canonicalizes the target and requires containment under the workspace root before any mutation.
Code Mode adds a third execution path — the `run_code` tool — that is **not** run through the sandbox at all. `run_code` hands the model's TypeScript body to `@deepseek-ai/dsh-code-runtime-worker-thread`, which spawns a Node worker thread and executes the program with `new AsyncFunction(...)` under an empty environment and a heap/time budget, but with **no file-effect confinement**: no `--experimental-permission`, no `ctx.sandbox.confine()`, no Landlock/Seatbelt profile. Because the worker thread shares the host process's UID and the OS kernel with no file-effect policy applied, the model program can `await import('node:fs')` to read/write any file and `await import('node:child_process')` to spawn arbitrary unsandboxed processes.
The consequence: in a deployment that runs Code Mode (`DSH_TOOLS_MODE=code` or `both`) alongside the **default** sandbox policy (`read-only`, or the permission default `workspace-write`), `run_code` is a complete escape from the file-effect sandbox — reading secrets outside the workspace, writing persistence files (`~/.bashrc`, `~/.ssh/authorized_keys`, cron), and running unconfined commands, all capabilities the sandbox is specifically built to deny. |
|---|
| Source | ⚠️ https://github.com/deepseek-ai/deepseek-harness |
|---|
| User | rockmelodeis (UID 100628) |
|---|
| Submission | 08/18/2026 17:29 (1 month ago) |
|---|
| Moderation | 09/28/2026 04:59 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 410977 [deepseek-ai deepseek-harness up to 0.1.0-rc.7 Code Mode Sandbox run_code sandbox] |
|---|
| Points | 20 |
|---|