Everything Is a Plugin Is a Security Statement

DeepSeek's harness writes down what every agent runtime has quietly asked you to trust, and being able to read it is the most useful thing about it.

Date: 2026-08-26 | Classification: TLP:CLEAR

Why this matters. Stop grading agent harnesses on how strong their isolation sounds. Grade them on what they mount and whether they tell you, because every plugin runs at the privilege of the loop it plugs into.

The Operator's Take

DeepSeek open-sourced its agent harness and the coverage landed on one sentence: an MIT-licensed competitor to Claude Code. That is the least interesting thing in the repository.

The architecture document says every part of the product is a plugin, including the model adapter, the tool registry, the session log, and the agent loop itself, so every part is replaceable from configuration. Then it says the consequence out loud: there is no privileged core to patch. Marketing reads that as composability. An operator reads it as a statement about trust, because if nothing is privileged then nothing is more trustworthy than anything else. All of it mounts the same way.

The security posture of a plugin kernel is the security posture of its weakest mounted plugin. DeepSeek is the first vendor to put that in writing, and the reflex to punish them for it is exactly backwards.

What Actually Happened

DeepSeek Harness, dsh, went public as an MIT-licensed agent runtime with roughly 197,000 stars on the repository as of this morning. It is not a finished product and it does not pretend to be. The latest release, dsh-v0.1.1-rc.2, is flagged prerelease. The README warns in capital letters that there will be compatibility-breaking changes. There is no SECURITY.md at the repository root; that path returns a 404 today.

Underneath sits Cordis, a plugin meta-framework. Plugins contribute services, typed events, and reversible effects to a shared context, and their registrations unwind when the plugin unloads. A preset is a directory holding a YAML file that mounts a set of plugins into an agent scope. Four ship in the box: Standard, Code, Minimal, and Creator. Creator lives in a repository directory named cordis, one of several places where the shipped names and the published names have not caught up.

Creator is the one to read. Its preset file carries a comment DeepSeek wrote about their own software, under the heading TRUST: cordis_mount evaluates model-written JavaScript against the live runtime, and a composition the agent writes becomes a preset that other sessions mount. Treat a session on this preset as shell access. Two hundred lines later, next to the tool that does it, the same file says the toolset is a trust boundary, not a sandbox.

So the model can mount code into the runtime that governs the model. The mode with the fewest walls is the one built for experimentation, and it is the one named Creator.

Seam	Replaceable from config	What that means for trust
Model adapter	yes	the thing being governed is a mounted peer
Tool registry	yes	the list of what the agent may do is itself swappable
Session log	yes	your audit trail is a plugin
Sandbox backend	yes	the confinement layer sits beside what it confines
The agent loop	yes	no supervising component sits above the rest

The part people will get wrong

The instinct is to read this as DeepSeek being less safe than the alternatives. It is not what the evidence supports.

Every agent harness on the market asks for the same trust. They load extensions, run hooks, mount tool servers, and execute what a model produced, at the privilege of the process doing the loading. What DeepSeek did differently is publish the seam list and write TRUST in capitals next to the sharpest one. Punishing the vendor that documented it teaches every other vendor to stop documenting.

What It Means

The controls in here are real, and worth naming before the criticism. Confinement is fail-closed by contract: the sandbox service must return enforcing arguments or fail at wrap or execution time, and the docs state plainly that silent unconfined passthrough is forbidden. Approval outcomes are a closed set that also fail closed, so a missing or broken answerer resolves to unavailable rather than opening the gate, and the never policy rejects rather than waves through. Spawned commands get an environment scrubbed of anything matching KEY, SECRET, TOKEN, or PASSWORD. That is a better default posture than a lot of shipped software.

Then read the sandbox document. Sandbox mode governs filesystem effects only. Network and process visibility, in DeepSeek's own words, are outside that vocabulary. Approval and confinement are independent controls doing different jobs: one decides whether to ask, the other bounds what a write can touch. Last week I argued the sandbox is the wrong wall to audit, because the privilege that matters belongs to whatever consumes the agent's output. Here is a vendor stating the same limit in their own reference documentation, unprompted, about their own product.

The Trajectory log is the other honest tension. Everything the model sees is recorded, and the invariant is that model-visible means logged: anything reaching a model request must be reconstructable from the event stream. That is a genuine advance in agent observability. It is also a file holding every prompt, every tool result, and whatever secrets passed through the session. Protect it like a credential store, not like a debug log.

Which leaves the thing worth carrying out of this. DSH is the most inspectable agent harness anyone has shipped, and its inspectability is precisely what lets you see how much trust these runtimes have always required. That is uncomfortable reading, and the discomfort belongs to the whole category rather than to DeepSeek. The gap that is theirs to close is the missing security policy on a repository this size, in a preview that warns you it will break.

So do not ask whether an agent harness is trustworthy. Ask it what it mounts, at what privilege, and whether it will tell you without being asked. One vendor now answers that in a text file you can read in a minute. Ask yours the same question and see how long the answer takes.

What Actually Happened

What It Means

Sources