low
DeepSeek open-sources dsh-superagent, a coding agent that acts on GitHub and team chat requests
1 fonte(s)
·
1 atualização(ões)
·
publicado 02/11/2026 04:09
·
coletado há 1 hora
DeepSeek released dsh-superagent, a research prototype of a coding agent that performs work on a GitHub repository. It acts when an allowed user asks, when a team-written rule covers the request, or when a chat or GitHub scope is opened so anyone can mention the agent. The article describes a product release, not an incident or vulnerability.
Detalhes técnicos
- The host enforces allow-lists and rules, so a message, comment or quoted document cannot expand what the agent is permitted to do.
- By default, non-explicit requests (unaddressed messages, bot messages, follow-ups from unlisted people) are assessed and logged as ones the agent would have accepted, but none is accepted. Explicit requests from allowed users work in every mode.
- A prompt called Delivery requirements controls auto-merge, and the host adds no merge logic of its own. By default the agent does not enable auto-merge under its own account, so people merge unless the prompt names another account.
Remediação
- Review the recorded would-have-accepted requests before switching to auto mode.
- Keep chat and GitHub scopes restricted to allowed users where possible, since an open scope lets anyone request work.
Linha do tempo
-
DeepSeek open-sources dsh-superagent, a coding agent that acts on GitHub and team chat requests
ler a análise desta fonte ocultar
DeepSeek released dsh-superagent, a research prototype of a coding agent that performs work on a GitHub repository. It acts when an allowed user asks, when a team-written rule covers the request, or when a chat or GitHub scope is opened so anyone can mention the agent. The article describes a product release, not an incident or vulnerability.
Technical Details
- The host enforces allow-lists and rules, so a message, comment or quoted document cannot expand what the agent is permitted to do.
- By default, non-explicit requests (unaddressed messages, bot messages, follow-ups from unlisted people) are assessed and logged as ones the agent would have accepted, but none is accepted. Explicit requests from allowed users work in every mode.
- A prompt called Delivery requirements controls auto-merge, and the host adds no merge logic of its own. By default the agent does not enable auto-merge under its own account, so people merge unless the prompt names another account.
Remediation
- Review the recorded would-have-accepted requests before switching to auto mode.
- Keep chat and GitHub scopes restricted to allowed users where possible, since an open scope lets anyone request work.