Prompt Injection in DeepSeek Harness via Context-Compaction

Executive Summary

This vulnerability affects DeepSeek Harness (dsh) developer preview, specifically commit c291e796. It involves improper handling of input for LLM prompting, allowing attackers to inject malicious instructions via crafted external content. The context-compaction feature automatically replaces conversation history with a model-generated summary without user notice. The summarizer reproduces parts of the conversation verbatim and preserves injected directives, including shell commands, across compaction sessions.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unauthorized shell commands or persistent directives in DeepSeek Harness (dsh) summaries. Check logs for unexpected network egress or suspicious process execution. Review generated summary files for verbatim reproduction of injected content, including shell commands or operational requirements.

Useful 0 Not Useful 0

Impact Analysis

An attacker can embed malicious instructions in external content like web pages, emails, or files. These instructions persist through compaction and may be executed during resumed sessions. While execution may be restricted in some setups, the payload remains preserved. Network egress is unrestricted, enabling silent data exfiltration without user interaction or privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to potential unauthorized data exfiltration and lack of input validation. Attackers can embed malicious instructions in external content that persist across sessions, enabling silent data theft without user interaction or privileges. The absence of provenance or trust marking for tool outputs further exacerbates risks of data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the context-compaction feature in DeepSeek Harness (dsh) commit c291e796 to prevent persistence of injected prompts. Review and sanitize all external content processed by the system, including web pages, emails, and files, to remove potential malicious directives. Monitor network egress for unusual data transfers as a precaution.

Useful 0 Not Useful 0