Summary
A prompt injection vulnerability in DeepSeek Harness (dsh) affects its context-compaction feature when it processes crafted external content. An attacker may influence the resulting context so that the system follows attacker-controlled instructions, potentially causing unauthorized actions, data exposure, or other unsafe behavior when the content is trusted by an AI workflow.
A prompt injection vulnerability in DeepSeek Harness (dsh) affects its context-compaction feature when it processes crafted external content. An attacker may influence the resulting context so that the system follows attacker-controlled instructions, potentially causing unauthorized actions, data exposure, or other unsafe behavior when the content is trusted by an AI workflow.
Affected context
The issue occurs in deployments that use DeepSeek Harness context compaction and incorporate external or otherwise untrusted content into the compacted context. Risk depends on whether that content is processed as trusted instructions and whether the resulting context is provided to an agent or workflow with meaningful permissions.
The issue occurs in deployments that use DeepSeek Harness context compaction and incorporate external or otherwise untrusted content into the compacted context. Risk depends on whether that content is processed as trusted instructions and whether the resulting context is provided to an agent or workflow with meaningful permissions.
Exploit preconditions
- Attack surface: External content processed by the context-compaction feature
- Required access: Ability to supply, publish, or influence content that the harness ingests
- Trigger point: Context compaction and subsequent use of the generated context
- Why exploitation is possible: Crafted content can be interpreted as instructions rather than untrusted data, allowing attacker-controlled directives to influence downstream model or agent behavior
- Attack surface: External content processed by the context-compaction feature
- Required access: Ability to supply, publish, or influence content that the harness ingests
- Trigger point: Context compaction and subsequent use of the generated context
- Why exploitation is possible: Crafted content can be interpreted as instructions rather than untrusted data, allowing attacker-controlled directives to influence downstream model or agent behavior
Why this happens
The underlying bug is an insufficient separation between external data and instructions during context compaction.
Crafted content can survive or be transformed by the compaction process in a way that gives it undue influence over subsequent model instructions. This behavior maps to CWE-94: Improper Control of Generation of Code, as attacker-controlled content can affect executable or instruction-like behavior in an automated processing pipeline.
The underlying bug is an insufficient separation between external data and instructions during context compaction.
Crafted content can survive or be transformed by the compaction process in a way that gives it undue influence over subsequent model instructions. This behavior maps to CWE-94: Improper Control of Generation of Code, as attacker-controlled content can affect executable or instruction-like behavior in an automated processing pipeline.
Potential impact
- An attacker may influence model responses or agent decisions
- Sensitive information could be disclosed through manipulated workflows
- Automated actions could be triggered without appropriate authorization
- Data-processing results may be altered or corrupted
- Downstream systems could be affected if the agent has privileged integrations
- An attacker may influence model responses or agent decisions
- Sensitive information could be disclosed through manipulated workflows
- Automated actions could be triggered without appropriate authorization
- Data-processing results may be altered or corrupted
- Downstream systems could be affected if the agent has privileged integrations
General mitigation guidance
Mitigation generally focuses on treating all external content as untrusted data and preserving a strong boundary between data and instructions.
Common defensive patterns include:
- Isolating external content from system instructions and control metadata
- Applying structured, context-aware sanitization and validation before compaction
- Using explicit trust labels and provenance tracking for ingested content
- Requiring confirmation or policy checks before consequential actions
- Limiting agent permissions and integration scopes according to least privilege
- Preventing compacted context from silently changing security policy or authorization decisions
These controls reduce the chance that manipulated content will control downstream behavior.
Mitigation generally focuses on treating all external content as untrusted data and preserving a strong boundary between data and instructions.
Common defensive patterns include:
- Isolating external content from system instructions and control metadata
- Applying structured, context-aware sanitization and validation before compaction
- Using explicit trust labels and provenance tracking for ingested content
- Requiring confirmation or policy checks before consequential actions
- Limiting agent permissions and integration scopes according to least privilege
- Preventing compacted context from silently changing security policy or authorization decisions
These controls reduce the chance that manipulated content will control downstream behavior.
How teams detect issues like this
Organizations can identify prompt injection risks through:
- Static and semantic analysis of context-compaction and prompt-construction code
- Code review checks for untrusted content inserted into instruction-bearing fields
- Tests using adversarial external content and instruction-confusion cases
- Monitoring for unexpected tool calls, policy overrides, or sensitive-data access after content ingestion
- Policy enforcement requiring provenance, trust classification, and authorization checks for model-generated actions
Automated security review tools may help flag dangerous data-to-instruction flows, but behavioral testing remains important.
Organizations can identify prompt injection risks through:
- Static and semantic analysis of context-compaction and prompt-construction code
- Code review checks for untrusted content inserted into instruction-bearing fields
- Tests using adversarial external content and instruction-confusion cases
- Monitoring for unexpected tool calls, policy overrides, or sensitive-data access after content ingestion
- Policy enforcement requiring provenance, trust classification, and authorization checks for model-generated actions
Automated security review tools may help flag dangerous data-to-instruction flows, but behavioral testing remains important.
Sources
| Source | Link |
|---|---|
| deepseek. | deepseek.com |
| gist. | gist.github.com/ |
