Listen in the Podli app 🎧
Follow your favourite podcasts, listen offline and in the car with CarPlay and Android Auto, and always pick up where you left off. Free to try.
A free piece of software from DeepSeek, the Chinese AI lab, is now one of the fastest-growing projects GitHub has ever hosted: published on 13 August, past 225,000 stars and nearly 27,000 forks by mid-September. It is not a model. It is an agent harness, the software that decides what an AI model is allowed to touch, and its architecture is the reason for the growth: every layer of it is a swappable plugin.
Its own safety notice says it has not been audited and must not be treated as production-ready, and its own engineers write that the default credential store cannot keep a secret from the AI it serves.
In this episode, Stephen Forte covers:
- The number. 225,223 stars and 26,799 forks in 33 days, under an MIT license, with a new release the same week. The projects at the top of GitHub's all-time list took years to get there, most of them the better part of a decade.
- The architecture. The model, the filesystem and shell, storage, the scheduler and even the interface are plugins. A shipped plugin swaps the execution environment for a remote sandbox so nothing runs on your own hardware. It can hand a task to a Claude Code session, to OpenAI's Codex, or to any agent speaking the same open hand-off standard, and use the answer. Like the shipping container: standardize the box, not the cargo.
- Against Claude Code. Ahead: no subscription, open all the way down, any model including one hosted inside your own walls. Behind: three all-or-nothing permission presets, thin hooks into other systems, and the credential question.
- Your keys, both halves. The default store is a plaintext file, locked to your own user account, and the project's README says the agent's tools run as that same user, so the store "cannot isolate secrets from the agent"; an OS-keychain provider is deferred, not shipped. But every key is only a reference to an environment variable and the launch environment wins, so a secrets manager can hand the key in at launch with the file never written, and spawned commands get a scrubbed environment. A weak default, a real capability, and a decision the operator has to make on purpose.
- The warning, verbatim. "It has not undergone a security audit and must not be treated as secure or production-ready." Published in plain language, in the same box as the code, on day one.
- The close. 225,000 engineers have already voted for the architecture. The audit has not been held.
A note on specifics: star and fork counts are from the GitHub API on 15 September 2026; the credential behaviour is taken from the project's own READMEs and design notes at that day's commit. Vendors are named for identification, not endorsement.
Sources:
- deepseek-ai/deepseek-harness, repository and README. GitHub
- DeepSeek Harness safety notice (SAFETY.md). Safety notice
- Credential store README (dsh-credentials-local): precedence, the same-user limit, the deferred keychain provider. README
- CLI reference: credential resolution order and the subprocess environment scrub. Reference
The AI Brief from the YPO Technology Network is a daily executive briefing on the AI developments that matter to business leaders. Hosted by Stephen Forte.
