DeepSeek's open coding agent runs commands with full user access

DeepSeek has published dsh-superagent, the code behind the coding agent it calls Super-Agent, under the MIT license. Its own deployment notes say the agent’s sessions run “with danger-full-access as the operator’s OS user.” If your team wants to try an agent that picks up work from GitHub on its own, that line decides how you install it.

Bloomberg’s Debby Wu reported the release on Sunday, and The Next Web followed. Bloomberg framed it as DeepSeek’s challenge to Anthropic’s Claude Code. The repository adds what the coverage leaves out: how much the agent can touch on the machine it runs on.

What DeepSeek released

The README describes “a proactive coding agent for one GitHub repository.” It listens to GitHub and, optionally, Feishu, the ByteDance workplace chat app named by The Next Web. When someone on an allowed list asks for work, it opens a work item and does it in its own session and directory. It answers in the same thread, for example with a pull request, and a web panel shows what needs a person.

DeepSeek labels it plainly: “Research prototype for reference only, not an official DeepSeek product.” The README calls it research code that may contain bugs and says the public version differs from the one DeepSeek runs internally. When we opened the repository on November 1, it held a single commit and about 6,700 stars.

It runs as a bundle for DeepSeek Harness, DeepSeek’s open-source agent app, which is in public preview. SETUP.md asks for Node.js 22.19 or later, GitHub CLI 2.48 or later, tmux and a few other tools. Harness also needs a model provider.

Why the access level matters

An agent that answers a whole team is only useful if it can act without a person approving each step. DeepSeek chose that: “Executor Sessions run commands without approval as the operator’s OS user,” and the deployment guide adds that a worker “can execute programs by path and read the operator’s home directory.”

The guards sit elsewhere. Worker shells drop environment variables whose names contain KEY, PASSWORD, SECRET or TOKEN. The authorization document says messages and comments “cannot change those permissions.”

But the agent’s account wrappers “do not isolate the process,” the deployment guide says. Anything readable under your login is readable to the agent. We think that makes this a tool for a spare machine or a separate user, not a developer’s daily laptop account.

The proactive part is also off by default. In the default observe mode, the agent judges unprompted work and records what it “would accept” without doing it; only auto acts on its own. Direct requests from people on the allowed list work in every mode.

What to do before you try it

• Create a separate OS account holding only the agent’s credentials. The deployment guide names this as the way to isolate it.
• Give it a dedicated GitHub account. Setup warns that “everything the agent writes appears under this name,” so never use your own.
• Keep the allowed list to yourself at first and stay in observe until the recorded decisions look right, as the philosophy document advises.
• Leave auto-merge off. SETUP.md recommends that people merge “until the agent’s pull requests have been right for a while.”

The trade-off is speed. Every step above adds setup time and slows the agent down, but a research prototype with one commit and full user access has not earned more yet.

Sources

• DeepSeek, dsh-superagent-prototype README, SETUP.md and docs 000, 002, 003 and 006, read November 1, 2026
• DeepSeek, DeepSeek Harness
• Bloomberg, report on the Super-Agent release by Debby Wu, November 1, 2026 (paywalled; read through Techmeme’s summary)
• The Next Web, DeepSeek open-sources Super-Agent, a coding agent that reads team chats, November 1, 2026