Updated November 10, 2026

By Cameron Voss and West Mao

DeepSeek SuperAgent Security: Permissions, Observe Mode and Safe Setup (November 2026)

A practical security checklist for evaluating the research prototype on a GitHub repository.

DeepSeek SuperAgent is a research prototype built on DeepSeek Harness, not an official DeepSeek product or production-ready software. It needs a separately configured model provider. This guide follows the published documentation; we have not run an end-to-end deployment for this article.

The public prototype coordinates agent work across GitHub conversations. A security plan must account for both who can request work and what the resulting worker can reach. This article explains the documented design and recommends a narrow trial; it is not a security certification or the result of a penetration test.

What can the agent access when it runs?

The published deployment documentation says its router and worker presets run with danger-full-access as the service’s operating-system user. A worker can execute programs and read files available to that user. It may also use the agent’s GitHub credentials to interact with its configured repository.

A dedicated GitHub identity is useful for attribution and limiting repository access, but it does not isolate the local process. A per-ticket directory or Git worktree separates changes for organization; it does not block filesystem, network or credential access.

What does observe mode actually do?

Start in observe to inspect whether rules would generate useful or noisy work. It is a policy setting for inferred activity, not a dry-run switch for all agent actions. An allowed person’s addressed request can create a ticket and run a worker in any of these modes.

Who can start work, and who can continue a conversation?

The host applies source policies and allowed lists when deciding whether to admit a new request. An allowed person addressing the agent can make an explicit request. Other messages may be evaluated as inferred candidates according to the source policy.

Once a ticket subscribes to a thread, messages in that thread can reach it as context, including bot and CI messages. They do not grant new authority by themselves: the ticket’s mandate still defines its scope. The documentation also says a person’s message on an ended ticket’s own thread can resume that work, regardless of sender. For a public repository, account for who can post or influence material in subscribed threads; a short requester allowlist alone does not make all later inputs trusted.

What protects against prompt injection?

No single setting eliminates it. Issue bodies, comments, logs and repository files can contain instructions from people who should not control the agent. The documented authorization model treats those messages as inputs rather than permission changes, but a model can still misinterpret hostile content or act within privileges it already has.

• Use a private test repository and limit who can contribute or comment during the trial.
• Run with a dedicated OS identity and only the credentials and files the trial needs. Consider a separately managed VM or equivalent isolation with constrained network access.
• Do not put production secrets, deployment credentials or unrelated private repositories in the worker’s environment.
• Protect the default branch and require a human to inspect the diff and tests before merging.
• Monitor the agent account and be ready to revoke its credentials and stop the service.

These are risk-reduction measures, not a guarantee. The appropriate controls depend on the repository, hosting environment and consequences of a mistake.

How should you configure the first trial?

1. Limit the target. Choose one low-risk test repository and one small documentation task.
2. Separate identities. Use an agent-only GitHub user and CLI configuration. Give that user access only to the test repository.
3. Reduce host access. Use a dedicated operating-system account and review mounts, reachable services, environment variables and network access.
4. Set policy. Allow only the intended requester and start with inferred acceptance in observe.
5. Keep review human. Disable automatic merging; use branch protection and review each PR and check result.
6. Test the boundaries. Inspect ticket state, actual files changed and the credentials available to the runtime. Record unexpected behavior and stop if the scope is unclear.

Does changing policy immediately stop existing work?

Not necessarily. The documentation says policy changes notify affected live tickets but do not immediately revoke every active mandate. If you need to stop work, use the project’s stop controls, inspect active tickets and running processes, and revoke credentials or access as appropriate. Verify the result rather than assuming a configuration edit stopped every worker.

Can SuperAgent merge its own pull requests?

The project recommends starting with human merging. It describes an optional automatic-merge arrangement with additional controls; do not assume a prompt alone enforces your repository’s policy. Keep auto-merge disabled during the trial and use GitHub’s repository controls to require the reviews and checks your team needs.

What should you check before expanding access?

For the requirements and operating costs, read the SuperAgent setup and cost guide. For the internal flow between sources, tickets and workers, see the architecture guide.

Frequently asked questions

Is observe mode safe to use with production credentials?

Observe mode does not protect credentials from an explicit task or isolate workers. Keep production credentials out of a trial.

Does a dedicated GitHub user sandbox the worker?

No. It separates the GitHub identity; OS and infrastructure controls govern what the process can reach.

Is the prototype production-ready?

The maintainers describe it as research code to review and adapt, not production-ready software.