DeepSeek's New Coding Agent Can Read Your Home Folder

DeepSeek put a coding agent on GitHub that can sit in your team's repo and answer requests, for example with a pull request. It's MIT licensed and it picked up thousands of stars within days. And its own deployment guide says, in plain words, that it runs with full access as your user account and can read your home folder. Here's what it does, what the catch is, and how I'd set it up for a client.

What DeepSeek released

On October 31, 2026, DeepSeek published deepseek-ai/dsh-superagent-prototype on GitHub under the MIT license. The README describes it as "a proactive coding agent for one GitHub repository, packaged as a bundle for DeepSeek Harness," DeepSeek's open-source agent app.

How it works, per the README and setup guide:

• It listens to one GitHub repository and, optionally, Feishu chats.
• Someone on the allowed list comments @<agent login> <request> on an issue.
• It opens a work item, does the task in its own agent session and directory, and answers in the original conversation, "for example with a pull request."
• A web panel shows what needs a person.

DeepSeek is upfront that this is early. The README opens with: "Research prototype for reference only, not an official DeepSeek product," and asks you to review and adapt it before using it. Bloomberg reported that DeepSeek is aiming the agent at Anthropic's Claude Code, according to The Next Web. DeepSeek doesn't say that in the README or setup docs.

The design has a philosophy I like: "take as little human attention as possible, and give as much value as possible." The agent acts only when asked or when a rule the team wrote allows it, and new proactive work starts in a mode that only records what it would have done.

The catch: full access, as you

The deployment guide (docs/006) says both of the agent's presets, the worker that does the tasks and the router that runs the main session, "run with danger-full-access as the operator's OS user." It adds that the account wrappers "choose the agent's credentials by default; they do not isolate the process," and that "a worker can execute programs by path and read the operator's home directory."

DeepSeek's own fix: "For isolation, use a dedicated OS account containing only the agent's credentials." The setup guide also recommends a dedicated GitHub account for the agent, "never the operator's own," and leaving auto-merge off so "people merge until the agent's pull requests have been right for a while."

So the locked-down version takes some setup. Running it on your everyday laptop account means an agent that reads team messages can also read your home folder and run programs on your machine.

What it costs

The code is free to download under MIT. It runs inside DeepSeek Harness, and the setup guide says Harness "also needs a model provider," so model costs depend on the provider you configure. The prerequisites list is long too: Node.js, pnpm, git, tmux, Python and the GitHub CLI.

Here's how you get paid

My opinion, no income guaranteed: small dev teams will want an agent that turns issues into pull requests, and most of them won't want to work through a setup with this many security steps. Sell them the locked-down install:

• Separate accounts. A dedicated OS user that holds only the agent's credentials, plus its own GitHub account, so everything it writes shows up under its own name.
• Start narrow. A short allowed list of people who can ask it for work, and work nobody asked for left in observe mode (the default), which only records what the agent would have done. Widen both once that looks right. Requests from people on the list still run with the agent's full access, which is why the separate account matters.
• Humans merge. Auto-merge stays off. A person reviews every pull request.

Package it as a one-time setup plus a monthly check-in where you tune its prompts and review what it did.