The headline: Seven days after its v0.1 launch, DeepSeek Harness is already on its second release candidate. rc.8, out in the early hours of August 20, gives the execution layer three upgrades that matter more than their changelog entries suggest: native image input (so the framework can perceive the world, not just read text), installable sub-agents — Claude Code and Codex can now run inside Harness as subordinate agents — and, most importantly, a Codex non-interactive permission mode that lets tasks run without per-step human confirmation. In a framework where the agent can rewire itself, autonomy that grows this fast moves the permission boundary question from abstract to urgent. Review has to live where a self-extending agent cannot reach it.
Two release candidates in seven days
DeepSeek shipped Harness v0.1 on August 13. rc.7 arrived August 17 with plugin self-registration and a better Cordis plugin panel. rc.8 landed in the early hours of August 20 — two days after rc.7. That cadence is the story underneath the story: this is a preview product being pushed hard, and its developer ecosystem is explicitly warned to expect breaking changes (rc.8’s faster SQLite backend, for instance, is not backward-compatible with older session data).
What rc.8 actually changes
Multimodal input. The DeepSeek model adapter can now enable native image requests. The /goal and /plan commands accept mixed text-and-image input, and the @ menu can reference files and past sessions. This matters because DeepSeek’s own V4 models are text-only — their API rejects image data. rc.8 effectively adds eyes to the harness: the execution layer can now perceive screenshots, diagrams, and real-world context even when the model driving it cannot. That extends Harness from pure-text programming into tasks that touch the physical world.
Rival agents become subordinates. Claude Code and Codex can now be installed as sub-agents via profile bundles. When a sub-agent finishes, reportDelivery returns its results to the parent task and the parent resumes. Codex gains multiple named instances for parallel work. The significance is ecosystem-level: the two most prominent closed-agent products on the market are now pluggable components inside an open MIT-licensed orchestrator. The execution layer is being commoditized, and the “everything is a plugin” thesis now extends to entire competing agent products.
Non-interactive permission mode. Codex’s sub-agent mode adds a non-interactive permission mode that runs without per-step human confirmation. It exists to make long, parallel agent runs practical — but it also completes a trajectory this site has tracked all month. First it was agents acting without asking (AISI). Then it was a harness that could rewire itself (v0.1). Now it’s an explicit mode that removes human confirmation from the hot path. Each step makes the same thing more necessary: the permission boundary must be enforced by infrastructure the agent cannot modify, because the human is no longer in the loop to say no.
Why this sharpens the boundary question
None of these features is reckless by itself. Multimodal input widens what an agent can see; sub-agents widen what it can orchestrate; non-interactive mode widens how much it can do unattended. But they compound in one direction: the agent gets more capable, more modular, and less supervised at the same time. A harness that can hold Claude Code and Codex as sub-agents — both of which can be instructed by the orchestrator — and run them without interactive approval is a system where a single compromised prompt can drive two different frontier agents to act. The full-trajectory observability Harness records (system prompts, chain of thought, tool calls, sub-agent dispatch) is the right foundation for auditing what happened. It is not a substitute for gating what can happen. A readable log is hindsight; a boundary is foresight.
The design logic points the same way it did in v0.1, only louder: managed, bounded environments with out-of-band review gates and signed diffs are not a compromise for teams that want speed. They are the only place a non-interactive, self-modifiable agent can run safely. When the human is removed from the approval path by design, the enforcement has to live entirely in the environment — a sandbox the agent cannot escape, diffs it cannot self-sign, and a review queue it cannot reach.
What it means for teams
- Evaluate the framework, not the buzzwords. Preview-stage interface churn is real: SQLite storage is incompatible between rc versions, and third-party plugins lag the core. Benchmarks on your own workload, with your own prompt-injection tests, before trusting the autonomy features.
- Treat non-interactive modes as an architectural decision, not a convenience. The moment per-step confirmation is switched off, your review process has to have moved into the platform. If it hasn’t, you’ve just shipped a self-modifying agent with no enforcement layer.
- The sub-agent pattern is a new attack surface. Every orchestrator-to-sub-agent instruction channel is a potential injection path — including the parent agent’s prompt. Test that boundary explicitly, the same way you’d test a user-supplied string.
- Multi-model orchestration is now table stakes. Open-source harnesses can drive closed frontier agents, and vice versa. Choose your platform for the boundaries it enforces, not for which model is plugged into it today.
The take
Harness rc.8 is a fast, competent update: senses for a text-only model stack, first-class sub-agent orchestration, and better Windows ergonomics. But its real significance is directional. Multimodal perception, rival agents as subordinates, and a non-interactive permission mode all push the same way — agents that can see more, orchestrate more, and run longer without asking. That is precisely the trajectory that makes platform-level permission boundaries non-negotiable. DeepSeek is building the execution layer at speed and in public. The teams that win with it will be the ones who built the boundary at the same speed — because the agent is going to be capable of a lot more by next week.