DeepSeek Harness just went viral, then faced 14,560 controlled attacks

The bottom line

DeepSeek Harness just started trending, and researchers stress-tested it with 14,560 controlled attacks.

An arXiv paper submitted on August 17 and updated on August 18 evaluates DeepSeek Harness’s resistance to indirect prompt injection. The experiment covered 16 indirect content channels, text and file carriers, 35 attack targets and 12 attack methods.

The highest observed values reported in the paper include: hidden Unicode attack in file mode reaches 25.5% according to rules, fake-completion in text mode reaches 17.0% according to semantic model, and skills channel file mode reaches 16.0%.

But the title cannot be written as "DeepSeek Harness has a 25% chance of being hacked." This is a controlled local fixture experiment, and neither sensitive tools nor data are connected to real external systems; 25.5% is the highest observed value for a certain combination of attack methods, vectors, and determiners, not the average loss rate across all tasks.

An agent’s biggest threat is not profanity, but a command hidden inside a file

When an ordinary chatbot encounters a malicious prompt on a web page, it may generate a strange answer at most. After Harness connects tools, files, terminals, and workspaces, indirect prompt injection can become an action: reading a piece of content, mistaking it for a system command, and then calling a tool or sending sensitive results to the wrong place.

The paper tests texts, documents, tool results, additional context and skill channels. It is not asking "Will the model be deceived by a sentence?", but asking: After untrusted content enters the Agent loop, can it pass through the tool policy and reach sensitive actions.

What does the number 25.5% really mean?

Study the use of rule discriminators and semantic LLM discriminators. The two conclusions were different: the semantic decider counted the behavior as partial compliance more often, at 7.3%, and the rule decider at 2.0%.

This shows that the security assessment itself is also controversial: What is a "successful attack"? If the model outputs a dangerous plan but does not execute it, does it count? If a tool call is executed but there is no leakage, does it count? Different determiners will give different answers.

Therefore, the most valuable result is not a scary percentage, but a reminder to developers: security controls cannot only be placed in the model prompts, but also between untrusted content and sensitive actions.

Our judgment: Agent’s weakness is the authority chain

The stronger the Harness, the more context and tools it can access, and the more the attack surface becomes like a supply chain. True lines of defense should include content tagging, tool call approval, sensitive data isolation, least privilege, execution logging, and rollback operations.

This paper does not prove that DSH is necessarily dangerous in a real production environment, nor does it prove that changing the model can solve the problem. It's more like a stress test: let me tell you first, the Agent can't just rely on "please ignore malicious instructions" to save its life.

What to watch

• Whether the paper code and subsequent versions can reproduce the experimental results.
• Whether DSH has these controls built into the tool policy and plugin system.
• How the attack success rate changes under different models and different permission configurations.