Week three. After the RCE scare, a lot of projects would have gone quiet, or gone into damage-control. DeepSeek did something rarer: it wrote the honest sentence in its own safety notes, and then shipped two more releases in the same week.
The big story: a candid safety note
Buried in the v0.1.2-alpha.1 changelog is a line that deserves more attention than it got: the updated Safety Notice now states plainly that DeepSeek Harness has not been security-audited, and that sandboxing, approvals, and permissions do not guarantee isolation.
Coming right after a critical RCE disclosure, that reads like exactly the right move: name the limit instead of implying one. It doesn't make the product safer by itself, but it tells every team the one thing they most need to know — treat Harness as unaudited software, not a hardened boundary.
Two more releases: the 0.1.2-alpha line
v0.1.2-alpha.1 — a big one: subagents can pick their own provider, model, and reasoning effort within configured authorization; exact token usage after each answer; the Python SDK ships Windows x64; ACP gains full session, model, MCP, and permission support; and public WebFetch turns on by default with SSRF protection.
v0.1.2-alpha.2 — connection failures now surface in the UI with auto-retry and reconnect, token usage and elapsed time show at the end of each answer, and a Node.js 24.0–24.11.1 startup bug gets fixed.
The signals worth reading
ApiProxy is gone. The legacy interface was removed in favor of the `@Remote` gateway — one more breaking change riding quietly in a "Chores" section, and a reminder to read the small print at this cadence.
"Code Mode" is finally "PTC mode." The rename that started in rc.7 is now complete, with existing conversation records still readable.
WebFetch is on by default. Public web access now skips per-request approval, backed by built-in SSRF protection — a convenience/surface tradeoff worth being aware of.
The ecosystem this week
The community keeps maturing: a third-party desktop wrapper hit v4.0.0 with a lightweight rewrite, media has started calling Harness "黑鲸" (Black Whale), and write-ups are pairing it with Qwen3.8-Max as the case for "open source moving past the substitute narrative." The first-week retrospectives have settled into a consistent verdict: real momentum, still a production-risk question mark.
Our take
The safety note is the week's most important development, because it's the first sign of a project learning to be an operating system rather than a demo. Shipping fast and being candid about limits aren't opposites — the best young infra does both. The 0.1.2-alpha line is the proof: subagent model selection and exact token reporting are the kind of features you build once people actually run your thing day-to-day.
The pattern to watch: features are now outpacing hardening, and DeepSeek knows it — it said so itself. For teams, the practical line stays the same as last week: play freely, hold production until the audit exists, and read every release note like it's a breaking-changes log.