security: add Harness authority-regression gate for sandbox escape class #13

New issue

Open

opened 2026-09-09 13:47:37 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-09 13:47:37 +00:00

Owner

Goal

Prevent a future dependency bump or compatibility edit from re-accepting a Harness release with the CVE-2026-82533 authority-escalation class.

Security invariant

AgentProlog must fail closed on any known-vulnerable DeepSeek Harness identity before its plugin/runtime is activated. The agent must never be able to obtain broader host authority merely by changing Harness session configuration over a model-reachable control plane.

Work

Add explicit compatibility regression coverage for CVE-2026-82533.
Test that 0.1.1-rc.2 / b150a551b8d465e31e418e1b2eaf5e79bbb7d28e is rejected.
Test that the reviewed fixed identity 0.1.2-rc.1 / a66e4702047846cdaa10c66c9d3df3951f5ea70d is accepted.
Add a machine-readable known-vulnerable floor/deny rule rather than relying only on a comment.
Preserve exact version+revision matching as the final host compatibility boundary.
Add a source scan/test that fails if vulnerable 0.1.1-rc.2 DeepSeek package specs reappear in AgentProlog manifests/lock data.
Document that AgentProlog's stdio Prolog sidecar is not a substitute for Harness control-plane authentication; both boundaries must hold.

Acceptance criteria

Security regression test fails against the pre-fix dependency/pin state.
Security regression test passes on the fixed release train.
Known-vulnerable Harness identities produce a dedicated structured security error.
No network-based AgentProlog sidecar transport is introduced as part of the fix.

Depends on #13.

## Goal Prevent a future dependency bump or compatibility edit from re-accepting a Harness release with the CVE-2026-82533 authority-escalation class. ## Security invariant AgentProlog must fail closed on any known-vulnerable DeepSeek Harness identity before its plugin/runtime is activated. The agent must never be able to obtain broader host authority merely by changing Harness session configuration over a model-reachable control plane. ## Work - Add explicit compatibility regression coverage for CVE-2026-82533. - Test that `0.1.1-rc.2` / `b150a551b8d465e31e418e1b2eaf5e79bbb7d28e` is rejected. - Test that the reviewed fixed identity `0.1.2-rc.1` / `a66e4702047846cdaa10c66c9d3df3951f5ea70d` is accepted. - Add a machine-readable known-vulnerable floor/deny rule rather than relying only on a comment. - Preserve exact version+revision matching as the final host compatibility boundary. - Add a source scan/test that fails if vulnerable `0.1.1-rc.2` DeepSeek package specs reappear in AgentProlog manifests/lock data. - Document that AgentProlog's stdio Prolog sidecar is not a substitute for Harness control-plane authentication; both boundaries must hold. ## Acceptance criteria - Security regression test fails against the pre-fix dependency/pin state. - Security regression test passes on the fixed release train. - Known-vulnerable Harness identities produce a dedicated structured security error. - No network-based AgentProlog sidecar transport is introduced as part of the fix. Depends on #13.

nsaspy added the

security

testing

labels

2026-09-09 13:47:37 +00:00

nsaspy referenced this issue from a pull request that will close it,

2026-09-09 13:48:43 +00:00

security: fix CVE-2026-82533 Harness pin #15