Secure Execution for AI Agents
DeepSeek Harness (harness.vin) manages agent code execution through plugin-based sandbox policies. The agent's persistent Bash and file-editing tools operate within policy-drawn boundaries, and sandbox policy facts are injected as runtime context. The official combo recommends running in a disposable checkout or container to keep your host system safe.
Security Mechanisms
Sandbox as a Plugin
Sandboxes, like every other capability, are provided by plugins — freely selected and replaced at the configuration layer to compose different execution environments.
Policy-Based Permissions
Sandbox policies draw the permission boundary for the agent's Bash and file-editing tools. The official example combo uses the danger-full-access policy, where Bash and the editor can access any path the runtime process can.
Transparent Policy Injection
Sandbox policy facts are recorded as runtime user context instead of being appended to the system prompt, so the agent always sees its own permission boundary.
Isolated-Run Guidance
Under danger-full-access, the official combo recommends running only in a disposable checkout or container to keep agent modifications away from the host environment.
Persistent Tool Environment
The agent executes code through persistent bash and str_replace_editor tools: the same session keeps its working directory, exported variables, and shell functions.
Configurable Policies
Tune sandbox security policies through plugin configuration, balancing safety and flexibility for each use case.
Use Cases
AI Automated Coding
Agents write, test, and run code in the sandbox — automating software development, code review, and bug fixes.
Data Analysis
Agents run analysis scripts in isolation, processing sensitive data and generating reports without security concerns.
Automated Testing
Agents execute test cases in the sandbox, verifying code quality and automatically finding and fixing issues.
Tool Calling
The sandbox backs agent tool calls with a secure execution environment for file operations, commands, and more.
Sandbox Run Example
Agents execute code within policy-drawn boundaries. The official combo uses danger-full-access — run it in a disposable checkout or container:
# Launch the Web UI and select an isolated workspace for the agent npx @deepseek-ai/dsh web # Headless mode: run one task and print the final answer dsh --profile headless "Inspect the repository and fix the failing tests." # Python SDK: give each task its own session; logs persist as JSONL python examples/jsonrpc-agent/minimal.py \ --workspace /absolute/path/to/workspace \ --session-root /absolute/path/to/sessions \ --session-id task-001 \ "Inspect the repository and fix the failing tests." # Note: the official combo uses the danger-full-access policy — # Bash and the editor can access any path the runtime process sees. # Run only in a disposable checkout or container.
Related Docs
FAQ
What is the DeepSeek Harness code sandbox?
Plugin-based sandbox policies draw the permission boundary for an AI agent's Bash and file-editing tools, with policy facts injected as runtime context.
What is a sandbox policy?
A sandbox policy defines what the agent's persistent bash and str_replace_editor tools may do. The official example combo uses danger-full-access — Bash and the editor can access any path the runtime process can — so it should run in a disposable checkout or container.
How does the sandbox stay secure?
Sandboxes are provided by plugins and composed at the configuration layer; policy facts are recorded as runtime user context rather than appended to the system prompt, keeping the agent's permission boundary visible.
Can the sandbox capability be replaced?
Yes — the sandbox is a plugin, freely replaceable and recombinable at the configuration layer to build the execution environment your scenario needs.