DeepSeek Super-agent: What It Is and What to Check First

DeepSeek Super-agent is an open-source coding agent for one GitHub repository, released on 31 October 2026 by DeepSeek’s Harness team. It is not a finished product. DeepSeek itself calls it a research prototype, and its own documentation says it runs with full access to the operator’s account. If you are curious rather than running an engineering team, that second fact matters more than the headlines.

This post rests on DeepSeek’s documentation and on launch coverage. We have not installed the prototype ourselves, so nothing here describes a hands-on test.

What DeepSeek released

The dsh-superagent repository describes a proactive coding agent packaged as a bundle for DeepSeek Harness, the company’s agent runtime. It listens to GitHub and, optionally, Feishu, the team messenger known as Lark outside China. When someone allowed asks for work, it opens a work item, handles it in its own session and directory, and answers in the original conversation, for example with a pull request. A web panel shows what needs a person.

The warning at the top of the repository is the part to read. DeepSeek says this is a research prototype for reference only and not an official product. It is not production-ready, it differs from the version the team uses internally, and some ideas in the accompanying design article are not implemented. The code is MIT-licensed, so anyone can use and change it. A licence tells you what you may do. It tells you nothing about safety.

If the vocabulary is new: generative AI and agentic AI differ mainly in how much happens before a person looks at the result. A chatbot hands you a draft. An agent takes steps. The worked examples of AI agents show what that looks like in practice.

What "proactive" actually means here

The launch headlines made it sound as if the agent roams a group chat and starts fixing things unprompted. The documents are more careful. According to the project’s philosophy page, it acts only when an allowed person asks or when a rule the team wrote permits it. Its stated principle is to take as little human attention as possible.

The authorisation document sets the default mode to observe. In that mode the agent assesses possible work and records what it would have done, but accepts nothing. The team reviews those records and switches on automatic work only if they look right. That is a sensible design. It is also a default, so it protects you only if you leave it on until you have read the records.

The access it gets is the real story

The deployment guide is unusually plain about this. Sessions run with a setting called danger-full-access, as the operator’s operating-system user. A worker can run programs and read the operator’s home directory. The account wrappers choose credentials but do not isolate the process. For real isolation, DeepSeek recommends a dedicated operating-system account holding only the agent’s credentials.

Put that on a work laptop and the agent can, in principle, reach whatever your account can read: SSH keys, .env files, a customer list in your downloads folder. Whether it would is a separate question. The technical barrier is simply not there. Add the problem every agent shares, which is that it reads text other people wrote, such as issues and chat messages, and that text can contain instructions. The same reasoning applies to an AI agent that takes control of a computer.

Where your data goes

Self-hosted does not mean local. According to ShiftDelete, the prototype needs a model provider configured in DeepSeek Harness, so whatever the agent reads may be sent to that provider. The useful question is which provider sits in your configuration.

If it is DeepSeek’s own service, start with the DeepSeek privacy policy, which says inputs such as text and uploaded files are collected and that personal data is processed and stored in the People’s Republic of China. Check whether separate API terms apply. This has drawn regulators before: Italy blocked the DeepSeek app in January 2025, though that concerned the app rather than this prototype, and we know of no action aimed at Super-agent.

Third-party guides such as ComputingForGeeks describe pointing Harness at a local model. We have not tested that. A local model answers the question of where data goes. It does not change what the agent can touch on your machine.

If you do try it

1. 01Use a test repository with no customer data and no secrets. The documentation says only github.com is supported, not GitHub Enterprise Server.
2. 02Run it under a dedicated operating-system account or on a separate machine, with nothing but the agent’s credentials.
3. 03Choose the model provider deliberately and read its terms before anything sensitive gets near it.
4. 04Keep the allowed list short and stay in observe mode until the recorded decisions look right.
5. 05Read every pull request as you would a new colleague’s. DeepSeek makes the operator responsible for what the agent posts, and checking an AI answer when you are not the expert applies to code as well.
6. 06Expect the ground to move. DeepSeek Harness is in developer preview, and its repository warns of compatibility-breaking changes.

Is this a Claude Code rival?

Bloomberg reportedly framed the release as a challenge to Anthropic’s Claude Code, and the comparison is fair as a direction of travel. As a choice you can make today, less so. One is a maintained product and the other is reference code its authors tell you not to treat as production software. If you want a comparison of tools people actually adopt, Muse Code vs Claude Code is closer to that question.

The honest answer for most readers is that you do not need this. Super-agent is for engineering teams with time to set it up and someone to own the result. What is worth taking from it is the rule behind it: an agent should act only when asked or when a written rule allows it, and should speak only when a person must act. That is a good test for simpler tools too.

Coursium is an iOS app that teaches beginners to give clear instructions, check AI output and apply it to everyday work. No agent removes that job. It moves it to the review step. You can try a free prepared practice example, or see what Coursium is and how it works.