A free piece of software from DeepSeek, the Chinese AI lab, is now one of the fastest-growing projects GitHub has ever hosted: published on 13 August, past 225,000 stars and nearly 27,000 forks by mid-September. It is not a model. It is an agent harness, the software that decides what an AI model is allowed to touch, and its architecture is the reason for the growth: every layer of it is a swappable plugin.

Its own safety notice says it has not been audited and must not be treated as production-ready, and its own engineers write that the default credential store cannot keep a secret from the AI it serves.

In this episode, Stephen Forte covers:

• The number. 225,223 stars and 26,799 forks in 33 days, under an MIT license, with a new release the same week. The projects at the top of GitHub's all-time list took years to get there, most of them the better part of a decade.
• The architecture. The model, the filesystem and shell, storage, the scheduler and even the interface are plugins. A shipped plugin swaps the execution environment for a remote sandbox so nothing runs on your own hardware. It can hand a task to a Claude Code session, to OpenAI's Codex, or to any agent speaking the same open hand-off standard, and use the answer. Like the shipping container: standardize the box, not the cargo.
• Against Claude Code. Ahead: no subscription, open all the way down, any model including one hosted inside your own walls. Behind: three all-or-nothing permission presets, thin hooks into other systems, and the credential question.
• Your keys, both halves. The default store is a plaintext file, locked to your own user account, and the project's README says the agent's tools run as that same user, so the store "cannot isolate secrets from the agent"; an OS-keychain provider is deferred, not shipped. But every key is only a reference to an environment variable and the launch environment wins, so a secrets manager can hand the key in at launch with the file never written, and spawned commands get a scrubbed environment. A weak default, a real capability, and a decision the operator has to make on purpose.
• The warning, verbatim. "It has not undergone a security audit and must not be treated as secure or production-ready." Published in plain language, in the same box as the code, on day one.
• The close. 225,000 engineers have already voted for the architecture. The audit has not been held.

A note on specifics: star and fork counts are from the GitHub API on 15 September 2026; the credential behaviour is taken from the project's own READMEs and design notes at that day's commit. Vendors are named for identification, not endorsement.

Sources:

• deepseek-ai/deepseek-harness, repository and README. GitHub
• DeepSeek Harness safety notice (SAFETY.md). Safety notice
• Credential store README (dsh-credentials-local): precedence, the same-user limit, the deferred keychain provider. README
• CLI reference: credential resolution order and the subprocess environment scrub. Reference

The AI Brief from the YPO Technology Network is a daily executive briefing on the AI developments that matter to business leaders. Hosted by Stephen Forte.