Alpha.1 closes a Windows deletion path
DeepSeek Harness published 0.1.7-alpha.1 on 22 September with a security-relevant Windows sandbox fix among a much larger set of agent and interface changes. The project says the previous behaviour could allow deletion outside authorised directories; the release also blocks deletion across workspaces.
The release note establishes that DeepSeek considers the path fixed in alpha.1, but it does not publish a CVE, root-cause analysis or independent reproduction. The narrow confirmed claim is therefore the maintainer-documented boundary defect and shipped fix, rather than a broader conclusion that the Windows sandbox is hardened against escape or destructive behaviour.
Alpha.2 repairs continuity after background work
A second prerelease later the same day, 0.1.7-alpha.2, fixes sessions that could stop progressing after several background commands or one-shot subagents completed. DeepSeek says completion-triggered agent wakeups are now unlimited by default, with an optional configured cap, so finished background work can hand control back to the agent without waiting for another user message.
The follow-up also fixes Web clients that appeared connected after a server restart but stopped displaying replies, preserves multiline queued messages when they are re-edited, and changes large tool-result spilling from a byte budget to an estimated token budget. Those are continuity and state-management changes around long-running agent work rather than new model capabilities.
The project still labels itself experimental
DeepSeek Harness explicitly describes itself as experimental developer-preview software that has not undergone a security audit. Its safety document says the program can execute model-generated commands, load third-party plugins and access the network, processes, credentials and files made available to it, and warns that sandboxing and approval prompts do not guarantee isolation.
That caveat is particularly important beside the deletion fix. Repairing one documented cross-workspace path narrows a known failure mode, but it does not turn the sandbox into a complete security boundary. DeepSeek recommends least privilege, disposable environments or containers, backups and careful review of plugins and commands.
What remains to verify
An independent check should reproduce the pre-fix Windows deletion case in an isolated fixture and then confirm that alpha.1 and alpha.2 reject the same operation. It should also exercise background-command completion, one-shot subagents and reconnection under crashes or restarts, because those paths are central to the reliability claims in the second prerelease.
Version 0.1.7 is still in alpha and the GitHub releases publish source archives rather than attached application binaries. Until the sandbox fix is independently reproduced and the project publishes a security audit or stable release, the evidence supports a concrete maintainer-confirmed repair with explicit residual risk, not a general security endorsement of DeepSeek Harness.