DeepSeek Open Sources a Super-Agent Prototype, a Coding Agent That Watches Team Chats

DeepSeek's Harness team on October 31, 2026 published dsh-superagent, an open source prototype of a coding agent that stays online, listens to GitHub and team chats, and turns requests into pull requests without a person opening a session. DeepSeek calls the MIT licensed code a research prototype, "not an official DeepSeek product," in the repository's README.

The release pairs working code with a long design article, posted in English on X on November 1, that argues today's AI agents are limited less by models than by human attention. It follows DeepSeek's push into agent tooling: the company said its V4.1 Flash 1017 model, released on October 17, 2026, was tuned for its DeepSeek Harness coding app, and three days later it open sourced its DeepInfer serving engine.

What did DeepSeek release?

DeepSeek released dsh-superagent, a proactive coding agent for one GitHub repository, packaged as a plugin bundle for DeepSeek Harness, its open source agent app. The agent listens to GitHub and, optionally, Feishu, the workplace chat app sold as Lark outside China.

When an allowed person asks for work, the agent opens a work item, handles it in its own session and folder, and replies in the conversation where the request came from, for example with a pull request. A web panel shows what needs a person. The README says coding agents did much of the engineering and that some designs in the article are not implemented.

How does the super-agent decide when to act?

DeepSeek's super-agent acts only when an allowed person addresses it directly or when a rule the team wrote allows proactive work, according to the project's authorization document. Proactive work starts in an "observe" mode by default, which only records what the agent would have done until a team switches to "auto".

The design rests on a principle the README states in bold: take as little human attention as possible, and give as much value as possible. In the design article on X, DeepSeek says that in its experience a person can follow only three to five active agent sessions at once. Its answer is a two layer system. A long lived Router session handles every human message and dispatches tasks but runs none itself, and isolated Worker sessions each handle one task. Follow up messages on the same pull request or chat topic go straight to the Worker that owns them without passing through the Router, a shortcut DeepSeek calls pass-through.

DeepSeek says its internal instance already runs continuously, reproducing and fixing issues and responding to code reviews for DeepSeek Harness itself. One internal rule it describes, "silently reproduce and fix," has the agent try to reproduce a reported bug in the background and speak up only once it has a simple fix.

How did it perform in DeepSeek's tests?

DeepSeek reports that its design finished tasks faster and more predictably than a single agent session using a subagent tool, at the cost of more tokens. The company calls the results indicative only: the tests used synthetic workloads, about 300 chat and CI messages per run of which about 20 were work requests, and a tool that simulated coding by consuming time. In the table, p50 is the median completion time and p95 the time within which 95% of tasks finished.

By that table, the super-agent used about 3.8 times the cached tokens of the neutral single session and about 2.1 times those of the delegation prompt version, a calculation based on DeepSeek's figures. In a separate stress test of the Router alone, DeepSeek says that as incoming events rose from about 1 to about 40 per minute, merging them into batches cut the average time per decision from 6.4 seconds to 1.6 seconds.

The finding cuts against advice Anthropic gave developers on October 22, 2026. In a guide for its Claude Platform, Anthropic said a single agent with skills frequently beat subagent designs in several enterprise deployments, often at lower cost and latency. The same guide, though, keeps subagents for tasks that run in parallel with fresh context windows, which matches the kind of workload DeepSeek tested. DeepSeek's article also credits Anthropic's April 8, 2026 engineering post, "Decoupling the brain from the hands," for the idea of keeping the agent loop separate from the machines it works on.

What are the risks of running it?

DeepSeek's own deployment guide warns that the agent's sessions run with full access as the operator's OS user, can execute programs and can read the operator's home directory. It recommends a dedicated OS account that holds only the agent's credentials, and a separate GitHub user account through which the agent comments and opens pull requests.

The design article names security and privacy as an open problem. An agent driven by group chats and emails takes in far more untrusted input, and DeepSeek writes that if a prompt injection compromised the cloud agent loop, every device connected to it could be taken over. A prompt injection is an attack in which instructions hidden in a message or document try to steer the agent.

The South China Morning Post, in a paywalled report, framed the release as part of DeepSeek's coding race with OpenAI and Anthropic.

What we don't know yet

• Whether DeepSeek plans to turn the prototype into a supported DeepSeek Harness feature, and on what timeline.
• How the design performs on real coding work rather than simulated tasks, and whether anyone outside DeepSeek has reproduced the test results.
• Which models DeepSeek used for the Router and the Workers in its experiments.
• Whether the cloud version described in the article, with personal machines connected to a hosted agent, will be offered as a service.