Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
OX reproduced a default DeepSeek Harness local control path: a confined coding agent called an unauthenticated loopback API, spoofed a trusted Host, changed its own session to danger-full-access, and disabled approval prompts.
ASSESSED SYSTEM
Shipped-default DeepSeek Harness agent session before the 0.1.2-alpha.1 fix, with the active sandbox and local loopback control API described by OX.
OUT OF SCOPE
The conditional network-exposed API path, model identity integrity beyond the same authorization failure, actual hostile victim exploitation, and universal deployment prevalence are outside scope.
Architecture: Agentic / MCP System (decision tree Q2) — The affected coding agent can invoke a shell and alter its own operational session through a multi-step task path. Tier 3: Tier 3 representative developer or internal AI workflow scenario; the original source does not establish every operator tier.
Documented attack or failure path
- The agent began inside an active sandbox with approval prompts.
- Its ordinary shell reached the unauthenticated loopback control API and submitted a trusted Host value.
- The API changed the same agent session to danger-full-access and disabled approvals.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.40 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.50 indeterminate | |||
| Containment (Cn) — scenario interval 0.00–0.88 (midpoint 0.44), Tier 3 MVT 0.50 indeterminate | |||
| Cn-2Escalation Prevention | 0.00w 0.12 | The default agent escaped its enforced execution and approval scope via a reachable local control API; only Cn-2 escalation prevention is scored 0.00 to avoid duplicate attribution. | OX executed a shipped-default local API call from a sandboxed agent and observed its session become danger-full-access with approval prompts disabled.source: primary report |
Unknown, not N/A: 25 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.75w 0.20 | Representative activity level for the documented bounded AI path; deployment-specific autonomy was not measured. |
| AsAttack Surface Exposure | 0.50w 0.25 | Representative exposure of the documented entry path; this is a scenario assumption and not a census of all operators. |
| CpCascade Potential | 1.00w 0.30 | No verified System Dependency Graph or DGC is published, so framework worst-case Cp default applies.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.50w 0.25 | A specific patch or configuration change is documented; repair feasibility is an inferred representative scenario, not measured recovery time. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | Minimal public provenance identifies the affected path but supplies no operator assessment pack, signed configuration inventory, or repeated metric battery. |
| Ec — Public evaluation coverage | 0.03 | coverage 0.04 (1 of 26 applicable sub-metrics) × independence 0.80 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.70 | Evidence dated 2026-09-08; age 40 days on the workpaper reference date. Components: C_monitor 0.70 · T_containment 0.74 · T_calendar 0.86. Binding term: C_monitor. Evidence reference is 2026-10-18, 40 days after earliest substantive public evidence (2026-09-08). C_monitor uses the conservative Tier 3 public-evidence default because usable monitoring-coverage evidence is unavailable; it does not assert no deployment telemetry. No C_event cap is asserted from research or an advisory without a dated victim incident. No generic C_evidence cap is assigned from missing public inputs. Indicative ERS uses normalized ACI = 1.00 for comparison only. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.17 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
4.1 midpoint, interval 1.2–7.0; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS · 2 records
CVE-2026-82533 CVSS 4.0 Base 9.4 Critical
| Published score | 9.4 |
|---|---|
| CVSS version | 4.0 |
| Metric group | Base |
| Severity | Critical |
| Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| Scored by | OX Security |
| Source record | https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/ (accessed 2026-10-18) |
| Affected component | DeepSeek Harness local control API default agent-session path |
| Scope note | OX original report publishes CVSS 4.0 9.4 for this vulnerability; the scored default local path has the same affected component. |
| Source note | Published OX CVSS 4.0 Base score and vector. Vector describes a broader exploit scenario than this bounded local default observation. |
CVE-2026-82533 CVSS 3.1 Base 9.6 Critical
| Published score | 9.6 |
|---|---|
| CVSS version | 3.1 |
| Metric group | Base |
| Severity | Critical |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| Scored by | VulnCheck CNA |
| Source record | https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82533.json (accessed 2026-10-18) |
| Affected component | DeepSeek Harness local control API default agent-session path |
| Scope note | Separate published CNA CVSS 3.1 Base comparison for the same CVE; not recomputed from the observed default exploit. |
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-D-015 | High-Risk Approval Bypass & HITL Activity DetectionExact upstream page defense ID, verified against AIDEFEND dataVersion 2026.10.15. Presence supplies no score credit. | Candidate evidence route | Fa-2 Tr-2 Cn-6 |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleExact upstream page defense ID, verified against AIDEFEND dataVersion 2026.10.15. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
| AID-H-004.002 | Service & API AuthenticationExact upstream page defense ID, verified against AIDEFEND dataVersion 2026.10.15. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-5 |
| AID-H-021.004 | Control-Plane & Oversight-Surface IsolationExact upstream page defense ID, verified against AIDEFEND dataVersion 2026.10.15. Presence supplies no score credit. | Candidate evidence route | Cn-2 Cn-5 Cn-9 |
| AID-I-001.004 | Sandbox Network Egress RestrictionsExact upstream page defense ID, verified against AIDEFEND dataVersion 2026.10.15. Presence supplies no score credit. | Candidate evidence route | Pr-2 Cn-7 |
| AID-M-001.005 | Public AI Endpoint & Agent-Service Exposure DiscoveryExact upstream page defense ID, verified against AIDEFEND dataVersion 2026.10.15. Presence supplies no score credit. | Candidate evidence route | Fa-3 Tr-4 Cn-5 |
WHAT THIS CASE TEACHES
OX reproduced a default DeepSeek Harness local control path: a confined coding agent called an unauthenticated loopback API, spoofed a trusted Host, changed its own session to danger-full-access, and disabled approval prompts.
Sources: Official AIDEFEND in Action brief · OX original disclosure, 2026-09-08 · VulnCheck CVE record, 2026-09-08