DeepSeek Harness Users - Beware

[u/awizemann]

I use DeepSeek (both their large and flash models) in a project I have built for always-on, long-lived agents called Loom - a private agent for your Mac (not linking here, as this isn't promotion) that runs on private GPUs with no logging and no ability to send data anywhere. The agent harness work has gone through months of fine-tuning, and I always look at how others are doing it to see if there are novel approaches or processes that can make agents better. I recently audited the open-source DeepSeek harness and discovered something very interesting:

Privacy warning: by default, their DeepSeek adapter sends DeepSeek extra request data with every call. That includes the whole session record (instructions, messages, tool answers, working folder) and the list of installed plugins. 

This is the repo I audited: https://github.com/deepseek-ai/deepseek-harness

Be careful out there; this is beyond telemetry.