DeepSeek Harness advisory says local processes could answer human approval requests
VulnCheck's 4 November advisory reports that DeepSeek Harness exposed an unauthenticated control plane through which local processes could invoke agent shell tools and bypass human approval.1 Approval identifiers exposed in a session stream were sufficient to answer pending requests, so the presence of an approval step did not establish reviewer authority.
The advisory establishes a vulnerability, not a confirmed enterprise breach. Exploitation dates and affected organizations are not established.
Source and credit: Jochanni Labs explanatory visual based on VulnCheck, 4 November 2026. Not a screenshot, reproduced exploit or customer system.
Runtime controls advance, with different evidence limits
| Organization | Reported response | Evidence level | Unverified |
|---|---|---|---|
| Algen3 | Require approval at the tool executor for CRM ownership changes. | 3 Nov: code and mock example. | Production behavior; reviewer mandate. |
| LangChain4 | Release strict stale-answer rejection in LangGraph 1.2.20. | 5 Nov: release and maintainer tests. | Exact tool-payload binding; reviewer authority. |
| Sysdig7 | Announce blocking or holding risky credential reads. | 4 Nov: general availability announcement. | Executor rejection traces; approval replay controls. |
Sysdig says policies begin in alert mode. Availability does not establish that customers enabled enforcement.
One new advisory and one research update
New, demonstrated vulnerability: DeepSeek Harness, CVE-2026-82033. The reported consequence is arbitrary command execution as the victim user, including approval bypass. The advisory identifies versions before 0.1.2-alpha.2; its commit references need clarification.1
Update, demonstrated vulnerabilities: Cymulate's 3 November synthesis connects earlier findings into two researcher-demonstrated chains reaching privileged Azure and GCP identities. Execution-sensitive configuration writes and workspace executable launches crossed trust boundaries without the required approval. These are demonstrations, not reported customer compromises; underlying test dates are unspecified.2
In this reviewed case set: two vulnerability reports, one new and one update. No confirmed unauthorized production execution or blocked production attempt was established. These counts are not an incident rate.
Check the action where it changes the system
| Domain / source | Exact action | Authority check belongs | If absent |
|---|---|---|---|
| Agent host1 | Execute a shell command. | Command executor, before process creation. | Commands run as the victim user. |
| Development / cloud2 | Write execution configuration or change a setup script. | Configuration write and launch boundaries. | Attacker code runs and exposes cloud credentials. |
| CRM3 | Change an account owner. | Record-update handler, binding account and new owner. | An unapproved ownership change can execute. |
A fresh approval question needs its own answer
LangGraph's released changes give successive interrupts distinct identifiers. Maintainer tests report rejection of a retried answer once the next question is pending. Strict rejection is opt-in, with documented checkpoint exceptions; this is not proof of single-use downstream execution or authorized human review.5, 6
Algen describes an executor refusing calls without covering approval, storing exact parameters and recording idempotency keys. Interrupted writes remain indeterminate rather than automatically retried. Its example is synthetic, and the runtime is a single-node prerelease.3
Decision Governance is the category. The Decision Authority Layer is the runtime enforcement layer; DAL-X is the application Jochanni Labs is building. System access does not establish authority to execute a specific action. Enterprise trigger logic identifies actions requiring an authority decision.
Conditional assessment: DAL-style enforcement could stop an unauthorized shell command only if triggers cover it, reviewer authority is verified independently of exposed request identifiers, approval binds the exact payload, and every relevant execution path rejects missing, mismatched, expired or consumed authority before launch. This would not make an approved command correct.8
DAL-X status: the layer site reports real-system sandbox execution with no customer deployment. The application site still describes simulation with production controls incomplete. Neither establishes an enterprise pilot or production enforcement.9, 10
Test the reviewer and the reused response
Shell execution: submit approval from an identity lacking the required mandate, then retry an old response against a new command. Effective control requires executor rejection, no process launch, and matching authority and outcome records.
Watch for clarified DeepSeek patch references and LangGraph tests binding approval to exact tool arguments. Seek executor-level evidence behind Sysdig's blocking claims.
Sources and evidence scope
- VulnCheck: DeepSeek Harness Unauthenticated RPC Command Execution, 4 November 2026. Primary CVE advisory; exploitation dates unspecified.
- Cymulate: Across the Kill Chain, 3 November 2026. Primary researcher synthesis of earlier findings; demonstration dates unspecified.
- Algen: Approvals Belong in the Runtime, Not the Prompt, 3 November 2026. Author-described implementation and synthetic example.
- LangGraph 1.2.20 release, 5 November 2026, 02:20 UTC.
- LangGraph PR 9574: strict resume mode, merged 4 November 2026. Maintainer test report; not independently run.
- LangGraph PR 9589: distinct interrupt IDs, merged 4 November 2026. Maintainer test report; not independently run.
- Sysdig AI Defense announcement, 4 November 2026. Vendor claims, not independent enforcement tests.
- Jochanni Labs: DAL-X architecture. Undated; checked 9 November 2026.
- Jochanni Labs: DAL-X product. Undated; checked 9 November 2026.
- Jochanni Labs: DAL-X application. Undated; checked 9 November 2026.
Public primary sources only. No private enterprise telemetry or independently executed vendor tests. Absence of public evidence does not establish absence of enforcement.
Integration Action
Discuss a Paid Enterprise Pilot
The incidents covered this week share one structural gap: no authority check at the receiving system. DAL-X enforces that check in a simulated enterprise environment. A paid enterprise pilot would test it against one agent, one consequential action, and one downstream system.