DEV Community

correctover
correctover

Posted on Originally published at correctover.com

Tencent just proved DeepSeek Harness needs runtime security (17-25.5% injection) — CCS is the control

#security #mcp #ai #deepseek

TL;DR: Tencent's AI-Infra-Guard team published a formal security assessment of DeepSeek Harness (arXiv:2608.16393), showing indirect prompt injection succeeds at 17-25.5% across file/text/skills channels — and concluded agents need "controls that sit between untrusted content and sensitive actions." We built exactly that control: CCS (Correctover Conformance Shape), a 7-dimension runtime verification layer at the DSH tool-call boundary.

The paper (all numbers from the source)

Tencent (Zonghao Ying et al., arXiv:2608.16393):

  • 14,560 controlled executions, 16 indirect-content channels, 35 payload objectives, 12 attack methods
  • Highest attack success: 25.5% (hidden Unicode in file mode)
  • 17.0% (fake-completion in text mode), 16.0% (skills channel)
  • Conclusion: agents need controls between untrusted content and sensitive actions

Tencent found the problem. They didn't ship the solution.

The control: CCS

CCS (Correctover Conformance Shape) is a 7-dimension runtime verification protocol (structure/schema/latency/cost/identity/integrity/security) that sits at the tool-call boundary:

  • pre-execute: block dangerous tool calls (command injection, SSRF)
  • post-execute: scan outputs for leaked secrets / injection
  • subprocess / fetch wrappers: block credential exposure, SSRF
  • Signed CCS receipt (evidence chain) for every verdict

It's a live DSH plugin (npm: correctover), open source at codeberg.org/correctover-labs, free 200 calls/day.

Why this matters

  1. Independent validation: Tencent's 14,560-execution study is the strongest public evidence that DSH (and agent runtimes generally) need a control layer.
  2. It's ready now: npm install correctover → dsh plugin add correctover.
  3. IETF-aligned: draft-correctover-ccs-04 is the first Internet-Draft for AI agent runtime verification (a draft, not yet a standard).

Correctover — AI Reliability. Paper: arXiv:2608.16393. IETF draft (draft, not standard): draft-correctover-ccs.

Trying it in production? We're building CCS with real-world feedback — if you install correctover and it blocks (or misses, or false-positives) anything, tell us: support@correctover.com or a GitHub issue on codeberg.org/correctover-labs. One real report helps more than a hundred views.

Top comments (0)