Two developments in AI security this month are worth reading together. Each sounds like specialist news on its own. Together, they raise a practical question for any business using, or considering, an AI agent that can act on its own: what can the system actually reach when the boundary is tested?
The boundary had a gap nobody had checked.
DeepSeek Harness, an open-source tool that lets an AI agent write and run code on a computer, was found to contain a high-severity flaw identified as CVE-2026-82533. OX Security's technical disclosure gives it a CVSS score of 9.4 and shows that the agent could disable its own sandbox with a single local command.
The sandbox was intended to keep the agent's work inside a fixed boundary. The failure came from a permissions check that trusted a label supplied by the requester, rather than checking where the request had actually come from. Work meant to remain inside its own workspace could therefore receive wider access. OX Security states that it found the flaw on 24 August 2026, DeepSeek fixed it in release 0.1.2-alpha.1 on 27 August, and the disclosure was published on 8 September.
In our view, the lesson is not that this one tool proves all AI agents are unsafe. It is that a safety mechanism can sound reassuring while still carrying a gap that has not been tested. “It runs in a sandbox” is a claim about software. It is worth verifying before the software is trusted with a live business system.
The attackers are not waiting for permission either.
Anthropic's September 2026 threat intelligence report supplies the second half of the picture. Covering activity observed from December 2025 to August 2026, it describes attackers using AI agents to carry out reconnaissance and follow-up work across several stages of an attack. In one case, agents modified and rebuilt malware until it was no longer detected, while people selected targets and reviewed the information that had been taken.
Anthropic's conclusion is direct: “Sophisticated attacks no longer require sophisticated attackers.” The capabilities that make an agent useful for legitimate work can also help an attacker carry out more work with less specialist knowledge.
What this does not mean.
These findings do not show that every AI agent is unsafe or that every sandbox shares the DeepSeek Harness flaw, but they do show that the risk is not theoretical. Anthropic's report describes real attacks reaching organisations' own systems, even in cases where Anthropic's own platform was not itself compromised. In our view, what matters is precision about what an AI system is actually allowed to read, change, run or send.
What we would do about it.
Before giving an AI agent access to a live system, we would establish exactly what it can read, change or send, then compare that access with what the job actually requires. We would test the boundary rather than relying only on the vendor's description, confirm that security updates are being applied, and keep the human decision clear when the system reaches an exception.
That is one of the questions the Audit exists to answer: what the tool is allowed to do, what evidence supports the answer, and whether the controls still work when the system is used in practice.
