Localhost is not identity: controls for agent local APIs

An API that listens only on the local machine has reduced its network reach. It has not authenticated the calling process, the page opened in the browser, the installed extension, or the agent running within a sandbox. loopback is a routing property; identity and authority are different security properties.

This Evidence Brief compares two recent disclosures to derive a defensive contract for local APIs. It does not publish offensive steps, compare the products' overall security, or turn a vulnerability into an incident. Status: approved for publication on 11 September 2026 at 09:00 BRT. No control described here is claimed as deployed, tested, or operating in Trustyu Forge.

Factual scope

On 8 September 2026, OX Security published the disclosure for CVE-2026-82533 in DeepSeek Harness. According to research, versions up to 0.1.1-rc.2 exposed a local API without authentication and used information provided by the client as a sign of trust. In default configuration, an agent command executed within the sandbox reached the local interface and changed the policy of the session itself. OX reports correction on the line 0.1.2-alpha.1 and a retest on 30 August.

O GHSA-96p9-rh4f-92cf describes another composition in winml-cli: versions earlier than 0.4.0 expose commands over local HTTP without authentication and allow broad web sources. The registered precondition is the person keeping the service active and visiting a page controlled by a third party. The advisory indicates 0.4.0 Corrected version.

The cases have different surfaces, classifications, and preconditions. The denominator is two disclosures, not a market sample. OX's reference to more than 215,000 GitHub stars measures attention to the repository at that cutoff; it does not measure installations, users, vulnerable environments, or victims.

Public evidence of active exploitation, number of victims, confirmed leakage or financial loss in both cases was not found until 09/09/2026. Correcting the version reduces the risk described; it does not prove full audit or absence of other failures.

Trust Model

origem/processo ── autenticação ── autorização por capacidade ── efeito
       │                  │                    │                    │
       └──── contexto ────┴──── política ──────┴──── receipt ──────┘

The local address contributes only to reachability. The server must establish the remaining properties before the effect:

1. Effective Origin: browser, extension, process, container, sandbox, or operator.
2. Identity: verifiable principal bound to the correct session and channel.
3. Capacity: typed action, bounded target, and known consequence.
4. Policy: authority ceiling independent of customer and workspace input.
5. Evidence: reconstructible decision, version, identity, scope and outcome.

Invariant 1 — transport does not authenticate the caller

127.0.0.1, local socket or interface bind restrict possible paths. They do not distinguish all processes that share the machine or prove that the call came from the expected interface. Host, Origin, process name and fields sent by the client are context; used alone, they become self-certified statements.

A defensive contract requires:

• session identity generated by the server and connected to the correct channel;
• ephemeral credential, restricted to the audience and not reusable by arbitrary origin;
• peer and transport verification as additional signals, not complete identity;
• fail closed when identity, channel, or session do not match;
• rotation and invalidation when the interface restarts or the policy changes.

Negative tests

• headers that claim local origin do not turn an unknown client into a trusted one;
• another page, extension or process does not reuse the authorized session;
• calls internal to the sandbox do not inherit the identity of the operator;
• an expired or other instance session fails before taking action.

Invariant 2 — CORS does not replace authentication

CORS tells the browser which origins may read responses and, in some cases, send requests. It does not authenticate clients outside the browser or authorize privileged actions. An origin allowlist can reduce the web attack surface; it must still be combined with identity, session protection, content validation, and server-side authorization.

Negative tests

• origin not allowed is refused without arbitrarily reflecting the amount received;
• allowed origin without valid session is also refused;
• clients not subject to CORS must still pass through the same identity and authorization gates;
• preflight, redirect, and errors do not reveal additional data or capabilities.

Invariant 3 — the control API does not belong to the same plane as the agent

When a sandbox can reach the interface that changes its own policy, data and control share the same boundary. The plane that executes untrusted input should not have the capability to expand its own confinement.

agent data plane ── pedido tipado ── policy mediator ── control plane
        │                                  │                  │
        └──────── sem credencial ──────────┘      autoridade humana/serviço

The mediator must prevent an execution identity from:

• increase permissions of the session itself;
• disable approvals or auditing;
• read conversations, secrets or sessions of another principal;
• issue credentials with higher authority;
• change the policy that will evaluate the next action.

The effective policy must remain source-bound and be enforced at the point of effect. The harness can separate transient identity, capabilities, and runtime mediation, but this property must be demonstrated by contract and evidence, not inferred from the declared architecture. [HARNESS31-C2]

Invariant 4 — authorization accompanies consequence and target

An administrative route should not be secured just because the GUI normally asks for confirmation. Every way to cause the same effect needs to cross the same gate on the server.

A privileged request should carry:

{
  "principal": "ephemeral-session",
  "capability": "typed-action",
  "target": "bounded-resource",
  "policy_digest": "sha256:...",
  "approval_ref": "immutable-or-null",
  "expires_at": "rfc3339",
  "request_nonce": "single-use"
}

The example describes fields, not a full implementation. The approval_ref needs to link human or service identity, consequence, target, and validity. Nonce and expiration reduce replay; they do not replace channel authentication or policy verification.

Negative tests

• equivalent action by CLI, UI and API receives the same decision;
• approval for reading does not authorize execution or policy change;
• different target, capability or policy digest invalidate the approval;
• replay and concurrent use of the same request are rejected;
• error response does not include token, conversation, sensitive path, or integral policy.

Invariant 5 — sandbox includes network and control plane

Confining only filesystem leaves other authorities available. The threat model must explicitly decide on loopback, DNS, external network, sockets, IPC, metadata services, proxies, and control interfaces on the host.

The minimum design for an untrusted task is:

1. namespace or dedicated network policy when supported;
2. default-deny egress, allowed by destination and purpose;
3. control interface inaccessible to the agent principal;
4. credentials missing by default and, when indispensable, ephemeral and task-scoped;
5. time, volume, process and storage limits;
6. evidence receipt produced outside the agent's authority.

A local interface may remain necessary for development experience. In this case, the controller needs to survive the fact that browser, extension, and agent share the host.

Minimum Evidence Packet

{
  "service_version": "immutable-ref",
  "transport": "local-interface",
  "authenticated_principal": "opaque-id",
  "origin_context": "browser|process|sandbox|operator",
  "requested_capability": "typed-action",
  "effective_scope": "bounded-scope",
  "policy_digest": "sha256:...",
  "decision": "allowed|blocked|failed|inconclusive",
  "effect_receipt": "immutable-ref"
}

The receipt must not retain secrets, unnecessary PII, offensive payloads, or full session content. It must make it possible to reconstruct the version, principal, policy, capability, and result involved in the decision.

Release Gate

1. Is the local address treated only as a range restriction?
2. Does each client have verifiable, session-linked identity?
3. Is CORS restricted and separate from authentication and authorization?
4. Is the agent unable to reach or obtain credentials for the control plane that could expand its own confinement?
5. Are privileged capabilities typed, delimited and evaluated on the server?
6. UI, CLI and API cross the same gate by consequence?
7. Does the sandbox include network, loopback, sockets, and host interfaces in the threat model?
8. Are tokens ephemeral, audience-bound, non-exportable and invalidated at policy change?
9. Do negative tests cover browser, extension, process and agent within the sandbox?
10. Does Evidence Packet differentiate between lockout, operational failure, inconclusion, and success?

Passing this gate demonstrates only the tested scope. It does not prove complete security, absence of vulnerabilities, production readiness, or continuous operation.

Limitations and conflict of interest

• OX sells application security and has published the research it has conducted. Comparative execution and retesting strengthen disclosure, but are not independent corroboration.
• The second case is in the public advisory of the Microsoft project and has its own classification. Its low severity should not be directly compared to CVSS 9.4 assigned by OX to the other product.
• This brief generalizes architectural properties from two cases; it does not estimate prevalence.
• The text omits ports, commands, payloads, exploit URLs, and offensive sequence.
• No case authorizes accusation of negligence, intent, active exploitation or confirmed damage.
• No proposed control is stated as deployed or operating at Trustyu Forge.

Direct sources

1. OX Research — CVE-2026-82533.
2. Microsoft/GitHub — GHSA-96p9-rh4f-92cf.
3. DeepSeek Harness — official releases.
4. winml-cli — official releases.

Editorial and responsibility note

Facts about products and versions are attributed to the sources above. The invariants, contract, and negative tests are the author's professional analysis, not universal facts or claims that controls are already operating. This material is informational and does not replace a technical, legal, or security assessment. Trustyu and Tech Human work commercially on related topics. Research, structure, and writing were AI-assisted; Fernando Parreiras confirmed factual and authorial review and final approval on 9 September 2026. There was no additional independent human review.