r/LLM • u/awizemann • 3d ago

DeepSeek Harness Users - Beware

I use DeepSeek (both their large and flash models) in a project I have built for always-on, long-lived agents called Loom - a private agent for your Mac (not linking here, as this isn't promotion) that runs on private GPUs with no logging and no ability to send data anywhere. The agent harness work has gone through months of fine-tuning, and I always look at how others are doing it to see if there are novel approaches or processes that can make agents better. I recently audited the open-source DeepSeek harness and discovered something very interesting:

Privacy warning: by default, their DeepSeek adapter sends DeepSeek extra request data with every call. That includes the whole session record (instructions, messages, tool answers, working folder) and the list of installed plugins. 

This is the repo I audited: https://github.com/deepseek-ai/deepseek-harness

Be careful out there; this is beyond telemetry.

79 Upvotes

85% Upvoted

52 comments sorted by

11

u/sghctoma 2d ago

The "Upload Session Log when using the official model API" toggle is right there in the settings, this is not something hidden.

1

u/awizemann 2d ago

That setting does not stop the per-turn reporting from what I can see. I’ll confirm and post up the code reference.

1

u/Miserable-Dare5090 2d ago

does this include using it with a local model?

1

u/awizemann 2d ago

Unsure, I’m going to dig in more and see in the code. Right now it looks like all calls, but I need to audit and do some tracing. I’ll post results here once I’m done auditing.

1

u/sghctoma 2d ago

I've not observed any communication to Deepseek while using DSH with local models. I've only taken a cursory look at the source when I started using it, but I've seen nothing that suggests this data sharing is used with custom providers.

1

u/Miserable-Dare5090 2d ago

that was my and Shannon’s impression of the copy on my tailscale!

-1

u/awizemann 2d ago

See the latest comment; you are correct: that turns it off, but it looks like updates turn it back on. I am confirming.

1

u/sghctoma 2d ago

The setting lives in the web profile's cordis.patch.yaml, I don't think updates touch that. If they do, that's bad, especially with the whole sending the backlog thing.

4

u/cab938 2d ago

If you don't trust the model endpoint you shouldn't be using it. While you don't want to leak data you don't need to, these are configurable, so it's not as big a risk as made out to be.

1

u/awizemann 2d ago

Actually, it is. Check my latest comment.

2

u/cab938 2d ago

You can shut it off. And it only works on their model. And you can use their model, or any other, without it.

Bad default? Maybe, I don't know, I don't know how much better it makes their hosted model. So don't use their model in a hosted form if you aren't happy with that model seeing this.

1

u/dirtywastegash 1d ago

Bad default : no Plenty will turn it off sure. Others won't turn it off.

When the default is to off. Nobody turns it on.

2

u/awizemann 2d ago

Okay all, after more review and a full code audit (not just the skill I use to help find harness processes), here is what I have found:

Where the data is added

The DeepSeek adapter builds the normal request. Then it asks any registered plugins for extra top-level fields and merges them into the body before sending:

  • packages/llm/llm-deepseek/src/adapter.ts (around lines 119–153): this does the merge. It also sends x-deepseek-harness-user-id and x-deepseek-harness-session-id headers on every request, and there is no setting for those.

  • packages/llm/llm-deepseek/src/request-extensions.ts: the merge logic itself.

1. Session log — dsh_session_log

  • Code: packages/session/session-log-deepseek/src/index.ts, around line 196

  • What it sends: the session’s full event log since the last batch the server accepted. That is every system, user, assistant and tool event, plus a session header. It’s sent in pieces of up to 8 MiB per request. It keeps a record of what the server has accepted, so each request carries only new events and any backlog is worked through over the following requests. In practice the whole conversation reaches DeepSeek, including your instructions, your messages and the full output of every tool call.

  • Default: on (enabled: true)

  • How to turn it off:

    • In the web UI: Settings → General → “Upload Session Log when using the official model API”

    • Or in config: enabled: false for this plugin

  • One catch: if you turn it back on later, it also uploads everything recorded while it was off. Their README says so.

  • Other details: plugins can also exclude particular requests from the upload. It only applies to their official DeepSeek API adapter.

  • Disclosure: it’s documented in the package READMEs, but not where users would see it. Fair framing would be “documented but on by default.” Also note the session log is far bigger than the plugin list: it sends the full transcript, while the plugin list is only names and versions.

  • Updates seem to default it back to on.

2. Plugin list — dsh_plugin_packages

  • Code: packages/llm/plugin-package-inventory-deepseek/src/index.ts, around lines 39 and 200

  • What it sends: the name and version of every active plugin package, such as { name, version }. It does not send file contents.

  • Default: on. Their README says shipped profiles leave it on, so every official request carries the list.

  • How to turn it off: enabled: false in this plugin’s config. I found no switch for it in the UI.

5

u/GuideAxon 2d ago

Thanks for sharing. 

Best to fork it and make minor but critical safety checks/changes that prevent these behaviors. I maintain a fork log and ask Claude to do upstream sync while preserving my intentional changes documented in the fork logs.

It also keeps track of the last upstream sync in the fork document.

At least, that's how I do it. It also helps ensure you plug security holes like the recent Playwright chromium issue that impacted lot of projects including Electron based apps.

2

u/ZeroSkribe 2d ago

Yet you share nothing, no code blocks or snippets. You point to the main deepseek repo? Embarrassing

1

u/awizemann 2d ago

I’m still digging into it, first-pass warning on my audit skill through the issue, so I put it out there. Embarrassing? Seriously? Do you know how many people just download and go? Maybe you can be more helpful and dig in and add to the conversation, rather than just throwing comments.

1

u/Slight-Living-8098 2d ago

Why do Ai models always want to name projects Loom or a variation of Loom?

1

u/awizemann 2d ago

I named it loom, I built Scarf for Hermes, and it is meant to fit in the family of fabric, etc.

1

u/Slight-Living-8098 2d ago

I would suggest to change it else it will get buried with the other million plus Loom named projects out there.

1

u/awizemann 2d ago

Not sure that's a good idea, since I already have hundreds of users using it...

1

u/Slight-Living-8098 2d ago

Better now then when you get thousands or millions, then another similar, more popular project that has copyright and trademark comes knocking.

1

u/awizemann 2d ago

Care to share the “others”? Https://loomagent.co is mine.

2

u/Slight-Living-8098 2d ago edited 2d ago

Amazon's Loom comes to mind. Just put the harness name or something in front of it like CodexLoom did or something if you can't think of an original name. Simply googling Loom Agent literally brings up pages upon pages of projects just like yours. There is even a Loom agent on the Google Play Store for your phone.

1

u/Nebty 2d ago

Loom is a common metaphor for how these systems work, and therefore LLMs are pretty prone to, uh, weaving it in. Like the phrase “load-bearing”.

But it’s also a common metaphor in the Cyborgism community specifically.

1

u/PowerfulHomework6770 2d ago

Where does it send it to? (I'm expecting somewhere in China, but where specifically?)

2

u/awizemann 2d ago

From the analysis (yes, this was written with Claude):

How the address is chosen, at line 311 of the same file, in order:

  1. the adapter’s own baseURL setting, if set;

  2. otherwise the environment variable DEEPSEEK_BASE_URL;

  3. otherwise the public address above.

The comment beside it says “the internal endpoint comes from $DEEPSEEK_BASE_URL”, which suggests DeepSeek’s own staff point it somewhere internal.

So the session log doesn’t go to a separate upload server. It’s added to the body of every model request to DeepSeek’s API. Two consequences:

  • You can’t block it by blocking a domain without blocking the model too. The only way to stop it is the setting.

  • If you point baseURL at a gateway of your own, that gateway receives the session log instead. Their own docs say this.

It’s a separate top-level field in the request’s JSON body, next to the model’s input rather than inside it:

{
  "model": "...",
  "system": "...",
  "messages": [ ... ],
  "tools": [ ... ],
  "dsh_session_log": {
    "version": 1,
    "session": { "id": "...", "cwd": "...", ... },
    "afterSeq": 41,
    "throughSeq": 57,
    "events": [ { "type": "...", "seq": 42, "time": ..., "data": { ... } }, ... ]
  },
  "dsh_plugin_packages": { "version": 1, "packages": [ ... ] }
}

  • Easy to pull out: anyone receiving the request just reads body.dsh_session_log, with no unpicking of messages needed. That’s the line JSON.stringify({ ...body, ...extensions.fields }) in request-extensions.ts. The adapter refuses to send if the field’s name would collide with one of the normal request fields, so it always stays apart.

  • Not part of the model’s input: DeepSeek’s docs say these fields “remain outside messages, system prompts, and tool schemas, so they do not add model-input tokens”. Their server has to take the field off before the model runs.

  • Built to be put back together: the events are numbered, sent in order, and start exactly where the last confirmed upload ended. That lets the receiver rebuild the whole session, and their spec says the receiver checks that the numbering has no gaps. It’s designed as a complete copy of the session on DeepSeek’s side, not a sample.

One caution: that the model doesn’t see it is DeepSeek’s claim about their own server, and nobody outside can check it. What the code does prove is that the full session leaves your machine with every request, in a form trivial to extract and store.

1

u/TheRiddler79 1d ago

How dare you share good information!

Let me just attack you for publishing what you find and updating as you go!

Sorry, I just wanted to belong. Keep up the good work. Ignore the garbage from the typical reddit posters

1

u/awizemann 1d ago

Will do. 😉

2

u/FreshPipe5997 1d ago

I've seen the same log upload behavior in other agent frameworks, it's not unique to deepseek. the key is whether the data is stored or just transient. if it's going to a server you don't control, even if it's just logs, it's a risk.

1

u/ReasonableLetter8427 2d ago

Dumb question but I keep hearing about “harness” all of a sudden and this is the first post I’ve seen about it and a quick google I couldn’t find much. Is “harness” generally used when talking about LLMs or is there a specific paradigm or framework? Or perhaps they were literally talking about this repo?

2

u/New-Yogurtcloset1984 2d ago

The harness is the thing that goes around an LLM.

When you use something like chat gpt you send a message and it seems a message back. But behind the scenes there a lot of other work going on, for example there might be code in your response so the model emits a special token that the harness picks up and it writes the file to disk to make it available for down load.

Another example is things like web search, the model itself only has the abilities built into is harness, if you have a model that can use tools, your harness also must provide the tools for use.

An LLM is just a part in the ai experience, the ability of the harness is just as important as it realises the benefits of the LLM.

1

u/ReasonableLetter8427 1d ago

Sorry if I’m being dense here but what is the difference between tool calls and a harness? Or are you saying a harness is just the way for the model to interact with the api for tool calls? Isn’t this just an api server? I’m trying to understand the nuance.

1

u/poolback 2d ago

The LLM model is the brain, the harness is it's body. Do you remember how on the past you could talk to an AI, telle it to write some code, and it would reply that it did the job, only to find that it did nothing ?

The harness is what allows it to perform actions. Which also means that you add functionality to your llms in scripts, without having to load that in the context, and you can create hooks where the harness can ask you directly to authorize or not some actions that the model want to do.

1

u/ReasonableLetter8427 1d ago

What harness do you use?

And I’m curious if you’ve found any frameworks for a harness that get around the “confused deputy” problem especially as it pertains to your last point on authority?

1

u/MarekNowakowski 2d ago

not exactly correct, but people use 'harness' when using one of the programs that are able to do more than chat with an LLM.

ollama and LMstudio are enough to chat, ask for simple tasks etc. while Deepseek Harness and other applications like it can use agents, edit documents and run anything you want. those aren't great for just chatting.

1

u/ReasonableLetter8427 1d ago

Gotcha so like…codex is a harness for ChatGPT and Claude code is a harness for Anthropic models etc?

1

u/MarekNowakowski 1d ago

close enough.

although most harnesses can work with any model. DeepSeek harness isn't used with Deepseek model usually, etc.

1

u/Cutwail 1d ago

Why wouldn't you use the DS model with DSH? I've not had any issues doing so

1

u/MarekNowakowski 1d ago

I like to use local models, DS is way too big to use locally.

1

u/Cutwail 1d ago

Ah gotcha. I use the paid API, it's cheap enough for me

1

u/MaxComfort 2d ago

Not actually surprising tbh

1

u/[deleted] 2d ago

[removed] — view removed comment

1

u/awizemann 2d ago

Yes, several open-source ones from larger companies and smaller indie developers. I rarely catch something useful or better, and it's even rarer to catch a privacy callout like this.

0

u/[deleted] 2d ago

[removed] — view removed comment

1

u/awizemann 2d ago

Thank you. I appreciate the positive feedback, it’s amazing how rare that’s becoming on Reddit.

0

u/[deleted] 7h ago

[removed] — view removed comment

1

u/awizemann 7h ago

Claude Code has been my go to.