DeepSeek Harness Admits Prompt Injection by Design

DeepSeek released deepseek-ai/deepseek-harness on August 13, 2026, under the MIT license, and its Safe Use Policy documents a fact that most vendors bury or deny: the agent may execute commands embedded in content, even if those commands conflict with the assigned task. That is not a caveat. It is a description of prompt injection as an intended operating mode, written by the vendor. Review teams that wire this harness into CI without accounting for that behavior are accepting an undeclared risk.

What the Harness Actually Is#

DeepSeek frames the design as Agent = Model + Harness. The harness is the execution layer: file access, shell commands, tool calls, session memory, subagent delegation. Every part of that layer is replaceable. The New Stack reported that the model adapter, tool registry, session log, and agent loop itself are all plugins, and the documentation notes there is "no privileged core to patch." The project passed 33,000 GitHub stars within hours of publication, with a community plugin registry already forming around it.

That adoption speed matters. An MIT-licensed, model-agnostic harness that works with Anthropic, OpenAI, AWS Bedrock, Azure, and Google's inference platforms does not stay in the hands of early adopters. It spreads through organizations that already rejected proprietary tooling on principle.

Prompt Injection Is the Documented Behavior#

The Safe Use Policy's language is direct: the agent may execute commands embedded in content, even when those commands conflict with the assigned task. Security researchers at CSO Online described the harness as the new attack surface as early as August 12, the day before DeepSeek's release, because the pattern is not new. The harness wraps the model, gives it tools, and turns token output into shell commands and file writes. Malicious instructions in any content the agent reads , a GitHub issue, a pulled doc, a fetched webpage , can reach that execution layer.

The Google ADK comparison is instructive. In August 2026, security researchers at Pillar Security found that malicious instructions embedded in a pull request could redirect a triage agent operating with collaborator-level repository access. That was treated as a flaw to disclose. DeepSeek put the equivalent behavior in its policy documentation. Both produce the same result; one is described as a bug and the other as a feature.

The Plugin Architecture Compounds the Problem#

The Habr technical analysis describes DeepSeek Harness as a configurable runtime for constructing agents from model adapters, tools, session services, execution backends, permission policies, and agent loops. Each is a swappable plugin. That is architecturally elegant and auditorially difficult.

A given run's behavior depends on which plugins are mounted, which MCP servers are reachable, which tool registry version is active, and what the session log contains. Two runs against the same task specification can produce structurally different diffs if the plugin composition differs. Verdent's evaluation checklist, published August 14, identified exactly this: without pinning a version, commit SHA, model route, and permission policy, benchmark results are not comparable and audit trails are not reproducible.

This is the same failure mode present in Claude Code's architecture: when everything in the execution environment is configurable and community-extended, the diff in the PR is not a reliable description of how it was produced.

What This Means for Code Review#

A PR authored by a harness-based agent carries a provenance question that a PR from a human does not. The question is not whether the model is capable. It is whether the content the agent ingested during its run was clean.

If the harness read a GitHub issue, a JIRA ticket, an internal wiki page, or a fetched dependency README before writing code, any of those inputs could have carried injected instructions. The resulting commit reflects what the agent did, not necessarily what was asked. Standard CI , linting, type checking, test coverage , cannot distinguish between a diff that resulted from a legitimate task and a diff that resulted from an injected command that happened to produce syntactically valid output.

The provenance question also compounds across the session log. The append-only event stream DeepSeek ships is useful for replay and auditing, but only if the session log itself is treated as an artifact under version control, not discarded after merge.

What Review Gates Need to Add#

A PR from a harness-based agent should be treated as a new provenance class. The diff itself is not sufficient evidence of intent. Review gates that handle this class need four additional signals:

• The session log from the run, pinned to a commit SHA
• The plugin manifest active during the run, not the current default
• The list of external content sources the agent fetched or read
• A diff of the permission policy between runs if the harness is shared across tasks

None of these are exotic. They are what the Verdent checklist calls "correctness" and "control" evidence. The gap is that most merge gates were not built expecting to receive them, because most PRs do not originate from an agent with a documented tendency to execute conflicting commands.

Hyrax's six agent domains , security, code quality, reliability, API and data, ops, and UX , run against every PR regardless of origin. Harness-authored commits already show distinct patterns in that scan: unexpected scope changes, dependency additions that do not appear in task descriptions, and permission modifications that are syntactically valid but contextually anomalous. The 13-step verification Hyrax runs catches several of these before the PR reaches a human reviewer. The session log, if surfaced, gives the security agent a second signal to check against.

The appropriate response to the DeepSeek Harness is not avoidance. It is treating harness-authored PRs as a class that requires additional provenance, rather than one that can share a review queue with commits where a human typed every line.

Hyrax is live at hyrax.dev.