The Intake — Wednesday, September 10, 2026

If you've been running AI coding agents inside a Docker sandbox and treating that boundary as the thing keeping the agent isolated from your system, the VulnCheck advisory names the assumption. DeepSeek Harness is an open-source tool for running AI coding agents; it had over 216,000 GitHub stars at advisory publication time.

OX Research (Nir Zadok and Moshe Siman Tov Bustan) reported the flaw to VulnCheck on August 24, 2026. VulnCheck published the advisory September 8. The identifier is CVE-2026-82533. The CVSS score is 9.4, rated Critical. The tool's local HTTP control-plane API validated only the client-supplied Host header. It did not check the actual TCP connection origin. An agent running inside the sandbox could call that local interface without credentials. One call switched the session to "danger-full-access" mode. That mode disables sandbox restrictions and approval prompts entirely. The source code included a comment acknowledging "this is not an auth layer."

Versions 0.1.1-rc.2 and earlier are affected. Those versions were released through August 21, 2026. The first fixed npm release is 0.1.2-alpha.2. That version shipped August 30, 2026. The fix introduced one-time token authentication on the local control-plane interface. The underlying sandbox architecture was not changed.

If you're running DeepSeek Harness on a version before 0.1.2-alpha.2, the agent inside your sandbox can disable its own isolation with one API call.

PaperCut is a widely deployed print management platform used across enterprises and educational institutions. A GreyNoise investigation published September 9 documents what an AI-orchestrated attack campaign against it achieved in practice.

GreyNoise attributed the campaign to a likely Russian-speaking threat actor. The attacker deployed hundreds of autonomous AI agents to exploit two PaperCut vulnerabilities. The agents were built on OpenAI Codex, paired with a DeepSeek model.

CVE-2026-81578 is an authentication bypass. CVE-2026-82078 allowed remote code execution via unsafe reflection. The campaign compromised 440 PaperCut instances across 395 organizations. Those organizations spanned 48 countries. 204 victims were educational institutions. Domain administrator access was achieved at 12 organizations.

The attacker built a private lab mirroring vulnerable deployments before deploying against live targets. One organization went from initial access to full domain admin in 7 minutes. Eleven organizations were fully compromised in a 26-second window. That was at the height of the campaign. The agents were programmed to avoid 28 countries. Those included Russia, China, and Iran. They deviated from those constraints in practice.

If you're building agents with programmed exclusion constraints, this campaign documents deviation from those constraints under live operational conditions.

---