# Is DeepSeek Harness safe? What its safety notice and policy say > DeepSeek's own notice says the agent harness is unaudited developer-preview software that can run commands and load plugins. Here is what its license, permissions and privacy policy say. URL: https://claudegpt.si/news/is-deepseek-harness-safe Published: 2026-11-08T22:57:53.217Z Author: ClaudeGPT Si Newsroom Section: AI Tools Topics: DeepSeek, DeepSeek Harness, AI agents, Security Publisher: ClaudeGPT Si ## Key takeaways - DeepSeek's SAFETY.md says Harness is experimental, has not had a security audit and must not be treated as secure or production-ready. - Permissions pair a sandbox mode with an approval policy; the danger-full-access preset uses the never approval policy, and the notice says sandboxes do not guarantee isolation. - With DeepSeek's own models, the Harness privacy policy (updated September 20, 2026) says session logs are used for training and stored in China; with a custom model service it says it does not store input or output server-side. Is DeepSeek Harness safe? Its own safety notice says it is experimental software that has not been security audited and "must not be treated as secure or production-ready." The [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) repository adds that it can run model-generated commands and load third-party plugins, so the safe way to use it is in a disposable environment, with backups and a limited set of files. This page covers what the project's own documents say, as of November 8, 2026. DeepSeek Harness (`dsh`) is an open-source agent harness, the program that lets a model read files and run commands on your machine. For what it does and what the API costs, see our [explainer on what DeepSeek Harness is and costs](https://claudegpt.si/news/deepseek-harness-what-it-is-cost). For the company's chat app and API, see [is DeepSeek safe](https://claudegpt.si/news/is-deepseek-safe). ## What the safety notice says The repository's [SAFETY.md](https://github.com/deepseek-ai/deepseek-harness/blob/master/SAFETY.md) is the main document. The README tells users to read it before running the project. It says: - The software is "experimental developer-preview software" and "has not undergone a security audit." - It can execute model-generated code and commands, load third-party plugins, and reach the network, processes, credentials and files made available to it. - Wrong model output, defects, misconfiguration, malicious input or untrusted plugins "may damage the host computer, modify or delete files, disclose data or credentials." - Sandboxing, approval prompts and permission controls "can reduce risk, but they do not guarantee isolation or prevent damage." - Users should not rely on it "as the sole security control for untrusted workloads." The notice lists five habits: run with the least privileges needed, prefer a disposable virtual machine or container, keep backups of files the project can reach, do not expose sensitive credentials or data unless you accept the risk, and review plugins, configuration and proposed commands before letting them run. ## The permissions model The project describes permissions as two settings that work together: a sandbox mode and an approval policy. The [permission presets package](https://unpkg.com/@deepseek-ai/dsh-permission-presets@0.0.1-rc.3/README.md) bundles them into two default presets: | Preset | Sandbox mode | Approval policy | | --- | --- | --- | | `workspace-write` | `workspace-write` | `ask` | | `danger-full-access` | `danger-full-access` | `never` | The first asks before operations that need approval. The second, by its name and its `never` policy, turns approval prompts off and lifts the sandbox. The package says a session pins its preset when it is created, so a later change to the default does not alter a session already running. The Web UI guide says the agent asks for approval "before operations that need it under the active permission policy." The pages I read do not list which operations need approval, and they do not say what the sandbox blocks beyond its mode names. Two other limits from the docs. The `dsh` process uses the directory where you start it as its default location, and the session composer stays unavailable until you add and select a workspace. And SAFETY.md says a restriction cannot protect resources the project is allowed to reach, so a workspace that holds your credentials is not protected by the sandbox. ## The Web UI and network exposure By default the Web UI listens on loopback, which means only the same machine can reach it, at `http://127.0.0.1:3080`. According to the [web app README](https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/bundle/web-app/README.md), a launch token in the printed URL is exchanged for a signed session cookie, and that cookie authenticates every API call and WebSocket stream. The [public deployments guide](https://deepseek-harness.github.io/deepseek-harness/en/guide/public-deployments) covers putting it behind a reverse proxy. Its warnings are specific: - The printed URL "carries a process credential, so share it only with intended users." - An `http://` browser-facing root exposes the launch token in plaintext. - Neither the advertised URL nor the host check protects the listening port, so restrict it to the proxy or a trusted network. - TLS is opt-in. DSH does not obtain or renew certificates, and a bad certificate pair stops startup instead of falling back to HTTP. If you keep the defaults and do not publish the UI, none of these apply. ## License The repository is under the [MIT License](https://github.com/deepseek-ai/deepseek-harness/blob/master/LICENSE), copyright 2026 DeepSeek. MIT allows free use, modification and redistribution and provides the software without warranty. SAFETY.md repeats this: use is "at your own risk," and the authors are not responsible for lost files, lost or disclosed data or damage to computers. Third-party dependencies and their licenses are listed in the repository's THIRD_PARTY_NOTICES.md, which I did not open. ## Data handling and privacy The code is local, but the model usually is not. DeepSeek's [Harness privacy policy](https://deepseek.com/en/harness/privacy/), last updated September 20, 2026, splits it by model service: - **DeepSeek's official models.** The policy says account data, user inputs, uploaded content, model outputs, tool invocation information, plugin configuration and conversation data are collected, along with device, network, usage and crash data. It says session logs are used "to train and improve our technology." Data is stored in the People's Republic of China, and kept as long as you have an account. You can request opt-out of training at harness-privacy@deepseek.com. - **Custom model services.** The policy says "DeepSeek Harness does not store or process your Input and Output on the server side." Your input goes directly to the provider you configure, and that provider's policy applies. - **Plugins, MCP servers, Skills and Hooks.** The policy says these collect data directly and DeepSeek is not responsible for them. The policy does not say where API keys are stored locally or how local files are handled, and it gives no retention periods for logs. The company-wide [privacy policy](https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html), updated February 10, 2026, describes the same China storage and the training opt-out. ## What I found and did not find The project documents no specific vulnerability in the pages I read, and I am not claiming one. The repository's Security tab was not readable in this check, so I cannot say whether it lists advisories or a reporting process. The README also warns of "COMPATIBILITY-BREAKING CHANGES," so permission behavior may change between versions. ## How to run it with less risk Following SAFETY.md, start `dsh` inside a virtual machine or container, point it at a project under version control, keep the `workspace-write` preset, and read each command before approving it. Leave credentials out of the workspace. Add plugins only after reading them. If you want no data to reach DeepSeek, configure a custom model service and check that provider's policy first. ## Frequently asked questions ### Is DeepSeek Harness safe to use? DeepSeek's own safety notice says it is experimental, has not had a security audit and must not be treated as secure or production-ready. It advises running it in a disposable virtual machine or container with backups. ### Does DeepSeek Harness send my code to DeepSeek? With DeepSeek's official models, the Harness privacy policy says inputs, outputs and tool information are collected and may be used for training. With a custom model service, it says Input and Output are not stored or processed on DeepSeek's servers and go to the provider you configure. ### Is DeepSeek Harness open source? Yes. The repository is under the MIT License, copyright 2026 DeepSeek, which provides the software without warranty. ### Can DeepSeek Harness delete my files? The safety notice says model errors, defects, misconfiguration or untrusted plugins may modify or delete files. Approval prompts and the sandbox reduce the risk but do not guarantee protection. ## Sources - [SAFETY.md](https://github.com/deepseek-ai/deepseek-harness/blob/master/SAFETY.md), DeepSeek - [deepseek-ai/deepseek-harness](https://github.com/deepseek-ai/deepseek-harness), DeepSeek - [MIT License](https://github.com/deepseek-ai/deepseek-harness/blob/master/LICENSE), DeepSeek - [DeepSeek Harness privacy policy](https://deepseek.com/en/harness/privacy/), DeepSeek - [Publish the Web UI behind a reverse proxy](https://deepseek-harness.github.io/deepseek-harness/en/guide/public-deployments), DeepSeek - [dsh-permission-presets README](https://unpkg.com/@deepseek-ai/dsh-permission-presets@0.0.1-rc.3/README.md), DeepSeek - [Web app README](https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/bundle/web-app/README.md), DeepSeek - [DeepSeek privacy policy](https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html), DeepSeek