What happened
The local control plane is unauthenticated, so any process on the host — including another OS user — can create sessions, send prompts, read the live event stream, and approve tool calls by replaying identifiers broadcast on the ungated stream. Because the agent has bash and filesystem tools, a local attacker achieves arbitrary command execution as the victim user with their configured model credentials.
Why it matters
Agent harnesses run with broad tool permissions and stored API credentials. A missing-auth local RPC plane means any co-tenant process can hijack the developer's agent, run shell/file tools, and read model traffic — a containment failure on shared/CI machines where AI agents run.
Attack vector
The web profile exposes HTTP and WebSocket RPC (session.create, session.prompt) without authentication. A local attacker invokes session.prompt to trigger the agent's bash and filesystem tools as the victim user with their model credentials, intercepts live session traffic/logs over the ungated event mux stream, and bypasses human tool-approval checks via POST /api/respond by matching only broadcast rpcId/approvalId/sessionId values.
Affected systems
DeepSeek Harness < 0.1.2-alpha.2 (and commit 3e24087)
Mitigation
Upgrade to DeepSeek Harness >=0.1.2-alpha.2; see the fix commit and release tag dsh-v0.1.2-alpha.2.