207,000 stars. A 248-word warning.

In partnership with

On Thursday 13 August 2026, DeepSeek put a new piece of software on GitHub.

Within a few hours it had picked up more than 33,000 stars. Nineteen days later, as I write this, the counter reads 207.3k, with 24.1k forks behind it.

It is called DeepSeek Harness — dsh to its friends — and its pitch is four words long:

Sitting in that repository is a file called SAFETY.md. The README specifically asks you to read it before you run anything. It is 248 words long, and this is one of them:

Two hundred thousand people starred it. Two hundred and forty-eight words asked them not to trust it. I want to spend today in the gap between those two facts — because the thing that makes this software genuinely exciting is precisely the thing that makes it dangerous, and you cannot have one without the other.

🧩 What “everything is a plugin” actually means

Most software has a core. A privileged bit in the middle you are not supposed to touch, wrapped in an extension API that lets you bolt things onto the edges. Browsers work like this. So does VS Code. So does nearly every agent framework built in the last two years.

dsh does not have one. From the architecture documentation:

And then, without flinching:

Read that with an engineer’s eye and it is a lovely idea. The agent loop — the thing deciding what the model sees, when it runs, which tools it may call — is not special. It is a row in a configuration tree, sitting beside every other row, and you replace it by writing a different row.

The framework underneath is Cordis, and its formal basis was published alongside the launch and posted to arXiv on 26 August: Yifan Shi (Peking University and DeepSeek-AI), Wei Zhang (Peking University) and Tianyi Cui (DeepSeek-AI), “A Programming Paradigm for Spatiotemporal Composability” (arXiv:2608.25512, 92 pages). The abstract names the two properties the whole design turns on:

In English: unload a plugin and everything it ever did to the system unwinds cleanly, and plugins can declare what they need from each other without hard-wiring themselves together. That is a hard problem. It is properly specified. It works.

⚡ The genuinely clever parts

Three things in here are worth stealing regardless of what you conclude about the rest.

One: swap one thing, and the world moves. The filesystem provider and the subprocess provider share a single execution world. Point them at a remote sandbox and everything moves with them — the Bash tool, the terminal, the language server — with no forked implementations. The docs call these seams, and a seam has exactly three parts: a definition, a provider, and a consumer. One provider swap changes the entire product’s behaviour.

Two: the log is the truth. There is a runtime invariant with a slogan attached — “Model-visible means logged.” Anything reaching a model request must be reconstructable from the append-only session log, and the system asserts it at runtime. If you want to give the model a new kind of input, you must add a new durable event type. You cannot sneak context in the side door. As the architecture doc puts it: “Fork, resume, transcripts, telemetry, and persistence all derive from this stream.”

Anyone who has tried to debug an agent that did something inexplicable will feel something when they read that. Half the reason agent behaviour is unreproducible is that nobody can reconstruct what the model actually saw.

Three: the sandboxing is real work, not a checkbox. Subprocesses get wrapped in Linux bwrap/Landlock, macOS Seatbelt, or a Windows ACL restricted-token backend. Three operating systems, three genuinely different confinement models, all behind one seam.

✋ Correction, before I go further

I had a fourth item in this list, and checking it broke it. I am leaving the wreckage in because the wreckage is instructive.

dsh ships subagent providers for Anthropic’s Claude Code and OpenAI’s Codex. I wrote — following the launch-day trade coverage, which says exactly this — that it resolves each product’s binary from the host PATH, so you supply your own install.

The primary documentation says the opposite. From the Claude Code subagent README:

And bluntly: “there is no host-CLI fallback.” The Codex provider is the same, pinned to @openai/[email protected].

So it does not borrow your binary. It ships its own, pinned, and only your login stays native. Nor are these providers merely “switched off by default” — they are optional bundles that are not installed at all until you ask, and once installed the patch layer registers only a dormant provider, with the matching tool row carrying disabled: true.

Which is better security than I gave it credit for, and worse news for anyone building a mental model of this thing from headlines. Including me, forty minutes ago.

One quick word from today’s sponsor — then back to the plugin problem

Granola Runs Revenue On Attio

"When I think of revenue, I think of Attio." - Shreman Shrestha, Head of Business at Granola

Here's what that adds up to:

• Zero missed leads and 10x faster access to customer context

• Lead triage 83% faster

• Five hours saved per week with automated updates

Start Your Trial

🚪 Now the part that keeps me up

Here is the question that matters, and it has nothing to do with how good the architecture is.

Where do plugins come from?

DeepSeek runs no marketplace, no registry, no signing infrastructure, no review process. The README’s entire answer to discovery is one sentence:

A GitHub tag. A label that the author of the code applies to their own code.

As of today that tag returns 13,056 public repositories. JavaScript 7,089. TypeScript 3,942. Python 495. Rust 97. PowerShell 84. Then a long tail of HTML, Shell, C#, Go and Swift.

Thirteen thousand pieces of code, written by strangers, discovered by hashtag, mounting directly into your agent’s context tree — with no privileged core standing between them and anything else.

And because the tag is self-applied, it is not even a list of plugins. Sort the topic by stars and you get the harness itself at the top, then a design tool, then an orchestration framework, then — at 41.9k stars — a well-known open-source résumé builder. Whatever else that is, it is not a dsh plugin. A self-applied label is a search convenience. It is not curation, and it is certainly not vetting.

Meanwhile, third parties have started filling the vacuum with unofficial registries and “awesome” lists. Which is, if anything, the worse outcome: a discovery layer with the appearance of curation and none of the accountability.

📦 Installing one is a bigger deal than it looks

dsh plugin --profile demo add your-package          # from npm
dsh plugin --profile demo add ./hello-plugin.tgz    # from a tarball
dsh plugin --profile demo add github:you/plugin     # straight from a git host

That third form has a speed bump, and it is a good one. pnpm 10 and later refuses to run a git dependency’s prepare script until you explicitly allow it, so the first add fails and you have to opt in by hand.

To DeepSeek’s very great credit, their own documentation explains exactly what you are opting into:

That is the most useful paragraph in the entire documentation set. It is also a complete description of how software supply-chain attacks work, printed by the vendor, in the install guide, next to the command that causes them.

🕳️ The sandbox does less than you think

It would be easy to read “bwrap, Landlock, Seatbelt, restricted tokens” and conclude the blast radius is contained. It isn’t — and, again, the docs say so first.

That third row deserves a moment. The documentation’s own warning is that “callers requiring an absolute boundary must not treat it as full” — the named cases being older Landlock ABIs and the Windows runner. Which means the honest answer to “am I sandboxed?” on a given machine is: it depends on your kernel.

There is a quieter surface too. A running dsh composes configuration in layers: each bundle in order, then the profile’s patch file, then the home-level patch file, then any --patch overlay. Later layers win, and a patch replaces a row’s entire config rather than merging into it. A bundle can therefore silently overwrite a row contributed by an earlier bundle — including a base row — just by matching its id.

The row that configures your sandbox policy is a row like any other.

🎯 Somebody already attacked it. Here are the numbers.

This is the part I did not expect to find.

Four days after launch, a team put a security assessment of dsh itself on arXiv: “Security Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection” (arXiv:2608.16393, submitted 17 August 2026, revised 18 August), by Zonghao Ying, Xiangfan Wu, Huiyu Wu, Xing Zheng, Huangsheng Cheng, Xiaorong Shi and Jing Guo. The tooling is Tencent’s open-source AI-Infra-Guard.

They ran 14,560 controlled executions across 16 indirect-content channels — sixteen different ways of getting text in front of the agent that the user never wrote. The strongest results:

Those are two different scoring methods, so don’t rank the rows against each other. Read them one at a time and the top line still lands: roughly one attempt in four succeeded for hidden Unicode delivered through a file.

Hold that number. It connects to something that has already happened in the world.

👻 The worm you cannot see

In October 2025, Koi Security documented the first self-propagating worm in a code-editor extension marketplace and named it GlassWorm. Seven OpenVSX extensions were compromised on 17 October, accounting for 35,800 installations between them; more turned up on both OpenVSX and the Microsoft marketplace two days later.

Its trick was this:

Invisible characters. Code review sees nothing. The interpreter sees a program. The payload harvested npm, GitHub, Git and OpenVSX credentials, targeted 49 crypto-wallet extensions, and used the stolen publishing tokens to infect further packages — which is the definition of a worm. Its command-and-control was spread across memo fields on the Solana blockchain, a bare IP address, and a Google Calendar event as backup, which makes it effectively untakedownable.

And the delivery mechanism was the most boring thing imaginable:

Now put GlassWorm next to that 25.5%. Invisible-Unicode injection is not a theoretical risk to agent harnesses. It has been measured against this one, this month.

📮 Three more that map straight onto the plugin model

Clean for fifteen versions. In September 2025, Koi Security found postmark-mcp, an npm package acting as a Model Context Protocol server, downloaded around 1,500 times a week. Versions 1.0.0 through 1.0.15 were entirely legitimate. Version 1.0.16 added a single line: a BCC on every outgoing email, to an address the developer controlled. Koi’s framing is the one to remember:

The package was pulled after disclosure. Koi’s note on that: “deleting a package from npm doesn’t remove it from the machines where it’s already installed.”

The config file as payload. In December 2025, Check Point Research (Isabel Mill and Oded Vanunu) published CVE-2025-61260 against OpenAI’s Codex CLI. A repository containing a .env that redirected CODEX_HOME to a project-local folder, plus a matching config.toml with MCP server entries, caused the CLI to execute the declared commands at startup — no prompt, no approval. Why it was worse than it looked:

Reported 7 August 2025, fixed 20 August 2025 in Codex CLI 0.23.0. Now re-read the paragraph above about dsh patch layers overriding rows by id.

It comes back through the client. CVE-2025-6514, found by JFrog Security Research and published in July 2025, was OS command injection in mcp-remote — the shim that lets desktop AI clients reach remote servers. A malicious server could execute commands on the client machine via a crafted OAuth authorization_endpoint. CVSS 9.6. Fixed in 0.1.16. Nearly four weeks earlier, CVE-2025-49596 had given unauthenticated remote code execution against Anthropic’s own MCP Inspector below 0.14.1 — CVSS 9.4, credited on the advisory to Rémy Marot of Tenable, with Oligo Security publishing on it too — because there was “lack of authentication between the Inspector client and proxy.”

And in September 2025, CISA issued an alert about Shai-Hulud, a self-replicating npm worm that compromised over 500 packages, scanned for GitHub personal access tokens and AWS, GCP and Azure keys, published them to a public repository, then authenticated as the compromised developer to infect more packages.

None of these are AI problems. They are packaging problems, in an ecosystem that has now been handed the ability to run commands.

🛡️ What to actually do, if you’re going to run this

Eight days before I sat down to write this, on 20 August 2026, the UK’s NCSC published interim guidance called “Managing the cyber risk of agentic AI” — Toby W, Principal Security Architect. It is short, unusually blunt, and it lands directly on this question. On built-in protections:

Which is the same thing DeepSeek’s own SAFETY.md says in different words: “Do not rely on DeepSeek Harness as the sole security control for untrusted workloads.”

Two organisations with no relationship to each other, eight days apart, telling you the same thing about the same category of software.

The NCSC guidance includes two maturity ladders worth pinning above a desk.

Network isolation

Compute isolation

bwrap, Landlock, Seatbelt and Windows restricted tokens are Level 2. Real, useful, and not the top of the ladder.

So — concretely, ten things, in the order I’d do them:

1. Run it in something disposable. A VM or a container you can throw away. It is the second bullet in DeepSeek’s own SAFETY.md, right after “run with the least privileges and access required.”

2. Pin every plugin to a commit SHA, exactly as the docs instruct: github:you/plugin#<sha>. This is the highest-value line in this issue. postmark-mcp was clean for fifteen releases.

3. Treat dsh plugin add as sudo. Install-time code runs outside the sandbox. If you would not run that repository’s install scripts by hand, don’t add it.

4. Read the diff, not the README. And remember GlassWorm: your eyes can be beaten by whitespace. Use a tool that renders Unicode variation selectors visibly.

5. Don’t give it real credentials yet. Short-lived tokens, scoped keys, a throwaway account. Assume anything reachable is disclosed.

6. Cap the network at Level 2 minimum. An allowlist. Exfiltration needs an egress path — and DNS is an egress path.

7. Check what your sandbox actually reports. If enforcement says partial, you do not have the boundary you think you have. Don’t treat it as full.

8. Audit the config layers. dsh --profile web --dump-config prints the tree your machine really boots. Anything in it can be replaced by a later patch — so read what’s in it.

9. Never let repository-local config auto-load. That is CVE-2025-61260 in one line. If cloning a repo can change what your agent runs, then cloning a repo is code execution.

10. Be able to pull the plug. NCSC’s seventh consideration, and the one everyone skips: know how you stop it, before you need to.

🧭 The uncomfortable summary

I want to be fair to DeepSeek, because the easy ending here is a wag of the finger and it would be the wrong ending.

They shipped a real architectural idea with a 92-page formal paper behind it. They built confinement backends for three operating systems. They shipped support for two competitors’ products, pinned, uninstalled by default, dormant until asked. And they wrote a safety notice that tells you without hedging that the software has not been audited, that the sandbox does not guarantee isolation, and that you should not trust it as your only control. Most vendors would have written a paragraph about their commitment to security and moved on.

The gap isn’t in the engineering, and it isn’t in the honesty. It’s between 248 words and 207,000 stars — between what the documentation says and what the counter suggests people are doing on a Friday afternoon.

“Everything is a plugin” is a beautiful property in a system you fully control and an unbounded liability in one you don’t. The same sentence — there is no privileged core to patch — reads as elegance to an architect and as the absence of a trust boundary to anyone who has spent a week cleaning up after an npm compromise.

Both readings are correct. That is exactly what makes it worth writing about.

One small ask

If this was worth your ten minutes, send it to one person. That is the entire growth strategy here — no ads for ourselves, no growth hacks, just one reader telling another.

Three friends who subscribe gets you itscybernews stickers. Ten gets you the mug. Hit reply and tell me who you sent it to, and I will make sure it counts.

Or just point them here →

📚 Sources, and what I could not confirm

Primary:

• deepseek-ai/deepseek-harness — README, star and fork counts read 1 September 2026

• SAFETY.md — every safety-notice quote

• DeepSeek Harness documentation — architecture, sandbox subsystem, plugin publish/install guide, and the Claude Code and Codex subagent READMEs

• dsh-plugin GitHub topic — repository count and language split, read 1 September 2026

• arXiv:2608.25512 — Shi, Zhang & Cui, A Programming Paradigm for Spatiotemporal Composability

• arXiv:2608.16393 — Ying et al., Security Assessment of DeepSeek Harness with A.I.G

• NCSC, Managing the cyber risk of agentic AI — 20 August 2026

• CISA alert on the npm supply chain compromise — 23 September 2025

• GHSA-6xpm-ggf7-wc3p (CVE-2025-6514) and GHSA-7f8r-222p-6f5g (CVE-2025-49596)

Security-vendor research:

• Koi Security on GlassWorm — 18 October 2025

• Koi Security on postmark-mcp — 25 September 2025

• Check Point Research on CVE-2025-61260 — 1 December 2025

• The New Stack — 13 August 2026, for the launch date and the first-hours star count

What I got wrong and fixed before sending. The subagent correction above is one of twenty-four errors an adversarial fact-check pass found in my first draft. Two are worth naming: I originally wrote that the dsh-plugin topic held 150 repositories — it holds 13,056, which makes the point far more sharply than the number I invented. And I had the Claude Code and Codex integration backwards, following the trade coverage rather than the vendor’s own README.

What I left out on purpose. Several outlets and a great many social posts describe dsh as the fastest-growing repository in GitHub’s history, citing 100,000 stars in 48 hours or 22,000 in ninety minutes. None of it stands up against a primary source, so the only growth figures here are The New Stack’s — more than 33,000 stars within a few hours of launch — and today’s counter, read directly off GitHub. I have also seen dsh described as having a plugin marketplace. DeepSeek does not run one. Third parties have started building them, which is not the same thing.

If you try dsh this weekend: do it in a VM, and pin your plugins. That’s the whole issue in one sentence.