What did DeepSeek announce on 5 November 2026?
DeepSeek's Harness team published a progress update on the evening of 5 November 2026. The post was the clearest public measure of the product's reach since its summer launch. As of 4 November, Harness had 1.54 million daily active users, counted across people using DeepSeek's own API. Those users consumed about 92 trillion tokens in a day.
The same post reported roughly 35,000 third-party plugins. It said about 60% of active users had built or installed at least one of them. DeepSeek also outlined a support programme for plugin authors and confirmed that an official plugin marketplace is in preparation.
Bloomberg reported the numbers on 8 November, attributing them to a DeepSeek disclosure on X. The article put daily users at about 271,000 at the end of September. That followed the desktop release of Harness on 29 September, which gave the product a downloadable app rather than only a browser interface.
The comparison covers less than three months. Harness shipped its first public version, v0.1, on 13 August 2026. By early November it had roughly 5.7 times the daily users it reported at the end of September, using DeepSeek's own accounting. The jump followed the desktop release and a steady run of plugin-management updates through October.
DeepSeek is headquartered in Hangzhou and sells model access through an API that other agent tools can also use. Harness extends that position to the application layer, where the company controls the runtime as well as the model behind it.
The update did not disclose revenue, retention, paying-customer counts or a country breakdown for Harness. It also left the commercial model vague. The application is free and open source, while usage runs through a paid model API. That gap matters when reading any adoption figure tied to the product.
How large is 1.54 million daily users for an AI agent?
Dividing 92 trillion tokens by 1.54 million users gives roughly 60 million tokens per user per day, a figure Bloomberg also calculated. That is far above what someone typing into a chatbot would produce. Agent sessions resend context, call tools repeatedly and run background jobs, so a single task can consume millions of tokens.
A useful external benchmark comes from Google. At its I/O developer conference in May 2026, Google said its model APIs were processing about 19 billion tokens a minute. That works out to roughly 27 trillion tokens a day, a fraction of DeepSeek's stated daily total.
The comparison is imperfect. The disclosures cover different dates, products and accounting rules. Google measures traffic across its model APIs, while DeepSeek counts one application on its own API. Treat the gap as a signal of scale rather than a precise ranking of the two companies.
The 1.54 million figure also has a narrow definition. DeepSeek counts only users who connect through its official API. Anyone running Harness against another model provider, a local model or a self-hosted gateway sits outside the count. The true number of installs is therefore unknown, and plausibly higher.
Daily actives can also flatter an agent product. Scheduled jobs and background tasks can keep a session busy without a person present. DeepSeek's post does not separate human-driven sessions from automated runs, so the figure describes activity through its servers, not a headcount of people at keyboards.
Token volume is the number DeepSeek cares about commercially. Each request through the official API is billable, so a heavy agent workload is more valuable than a casual chat session. That explains why the company promotes plugins: every new workflow that depends on a plugin also depends on its model.
Why does DeepSeek describe Harness as an operating system?
Harness is not a model. It is an open-source agent harness under the MIT licence that wraps a model with tools, sessions, scheduled tasks and a plugin system. DeepSeek's product page calls the design “everything is a plugin”. Even built-in features can be replaced by third-party alternatives.
The architecture rests on Cordis, a framework DeepSeek credits with enabling composable plugins. The desktop app runs on Apple silicon Macs and 64-bit Windows. Developers can also start a local web interface with npx @deepseek-ai/dsh web, which serves on port 3080 by default and opens in the browser.
The product handles routine work as well as coding. According to DeepSeek's page, it can organise files, analyse spreadsheets, draft documents, build slides, research topics with citations and run scripts in the background. Experimental plugins add agent teams, automatic approval review, scheduled tasks and voice input.
DeepSeek says it wants Harness to become the operating system of the agent era. The argument is that a stable base should cover common work, while specialists build plugins for particular industries and personal habits. That division of labour is what turns a developer tool into a platform with its own supply side.
The term harness describes the scaffolding around a model. The August security paper identifies four parts that Harness preserves: an agent loop, a tool registry, a model adapter and a session-event path. Those pieces decide which tools the model can call, how results return and what survives between turns.
The model layer is DeepSeek's own. API documentation maps the model name deepseek-flash to DeepSeek-V4.1-Flash-1017 and also offers deepseek-v4-pro. Harness shows the Flash model by default in its interface. Because the API accepts OpenAI and Anthropic request formats, other tools can call the same models.
That creates an unusual competitive position. Harness competes with Claude Code, Codex and OpenCode for the same agent workloads. Yet DeepSeek's documentation lists those tools among supported integrations, so the company can earn token revenue even when a developer picks a rival interface.
Who builds the plugins, and what do they receive?
The update named several community plugins to show what the ecosystem produces. One, dsh-aio-agent, connects Cursor, Claude Code, Codex, OpenCode, CodeBuddy and Kimi Code behind a single interface. Another, dsh-ltm, adds local long-term memory with Chinese keyword search and per-project recall.
Other examples target narrower needs. A plugin called TheOne routes messages into separate sessions by topic, so unrelated projects do not share one conversation. A hardware project uses an ESP32-S3 board to control a non-jailbroken iPhone through screenshots, taps, long presses and text entry.
DeepSeek also highlighted individual creators. One built a media production desk for scripting, covers and storyboards. Another packaged design and copy-editing skills that turn an article into a web page or a card. A third exposes the agent's context trail so users can inspect what the model was given.
Plugins can be written in conversation. Harness includes a Creator mode that generates a plugin from a prompt, installs it and checks that it runs. DeepSeek's page shows a floating Pomodoro timer built this way, with the agent editing files and verifying the live plugin state.
The incentive plan is still taking shape. DeepSeek says it will offer token credits, technical exchanges and editorial promotion to plugin authors. It has opened an interest form for individuals and companies, but the rules and support levels will be published when the programme formally launches.
Community infrastructure is forming ahead of the official store. A separate MIT-licensed project, dsh-market, adds a plugin catalogue tab inside Harness with search, one-click installs, favourites and update checks. Its README puts its own catalogue at more than 4,200 packages, a narrower list than DeepSeek's 35,000 figure.
The announced programme does not include revenue sharing, paid plugins or certification for reviewed packages. Token credits lower the cost of experimenting, but they do not fund long-term maintenance. That gap matters for anyone whose daily workflow depends on a plugin written and maintained by a stranger.
Where does the plugin model break down?
Openness has a cost, and Harness users have documented it. One developer told Chinese tech outlet InfoQ that installing more than 15 plugins produced infinite loops, context overflow and rising token use. Each plugin adds descriptions and rules that the model must read before it acts.
The same report described a user who measured token consumption more than 20 times higher than OpenCode on a small project. That task took 30 to 40 minutes, against about 30 seconds in OpenCode. A single account is not a benchmark, but it shows why plugin count can change the cost of a task.
Upgrades have caused damage too. InfoQ described a Windows user who lost 32 of 34 configured plugin entries when moving from v0.2.1-rc.5 to v0.2.2-rc.1. The app failed to start, and recovery took about five hours because the client had no automatic configuration backup or rollback.
DeepSeek has been shipping fixes at a rapid pace. Releases between 15 and 23 October added custom plugin indexes, version compatibility checks, start-stop controls, dependency sync and hot reload. Later builds added long-conversation compression, update rollback and installation diagnostics.
The 4 November release, v0.2.2-rc.1, added mobile and tablet layout work, richer plugin pages and an experimental tool that hands isolated tasks to a local Codex or Claude CLI. It also sets separate byte budgets for global and project-level AGENTS.md files to reduce instruction conflicts.
The repository still carries a blunt warning. It says Harness is in developer preview and that “THERE WILL BE COMPATIBILITY-BREAKING CHANGES”. DeepSeek has promised steadier plugin APIs and a stronger security mechanism, but those are commitments rather than shipped guarantees for plugin authors.
The harder problem is governance rather than code. A working marketplace has to rank quality, verify compatibility, publish permissions and remove malicious packages. InfoQ's analysis argues those functions matter more as the catalogue grows, because the burden of filtering and maintenance grows with it.
For teams, the lesson is to treat a Harness profile as infrastructure. Pin plugin versions, keep configuration in version control and test upgrades before a whole group moves. The release cadence is fast, so upgrades deserve testing rather than a blind restart.
How exposed are Harness users to prompt injection?
A security assessment published in August 2026 used Tencent's A.I.G red-teaming framework to test Harness against indirect prompt injection. The study ran 14,560 controlled executions across 16 content channels and 12 attack methods. It used 35 payload objectives and scored outcomes with two different judges.
Attack success reached 17.0% for a fake-completion attack in text mode, measured by a language-model judge. Hidden Unicode characters in file mode reached 25.5% under a rule-based judge. The skills channel reached 16.0% in file mode under the same rule-based judge.
The two judges disagreed in useful ways. The language-model judge recorded partial compliance 7.3% of the time, against 2.0% for the rule-based judge. That spread suggests some attacks land partially rather than fully, which can still be enough to leak data or trigger a tool call.
Those numbers describe a laboratory setup, not production incidents. The researchers kept tools and sensitive targets as local fixtures, so attempted actions produced no external side effects. The tests also ran against the August build, which has changed several times since.
Indirect injection works by hiding instructions in material the agent reads. A poisoned README, spreadsheet cell or plugin description can tell the model to abandon its task and call a tool instead. The agent treats that text as data, but a capable model may still follow it.
The practical lesson is that plugins and files carry untrusted text into an agent that can run commands. A marketplace with tens of thousands of community packages multiplies that surface. DeepSeek says it will improve plugin security and review, but its post did not describe review criteria or revocation rules.
For teams, the safest posture is unglamorous. Install fewer plugins, prefer ones with visible source and keep credentials out of agent workspaces. The study's authors argue that controls belong between untrusted content and sensitive actions, not only inside the model's instructions.
What should you watch next?
The official plugin marketplace is the next real test. Its review process, permission model and update policy will decide whether 35,000 plugins become an asset or a liability. DeepSeek has said only that it wants uploads and discovery to be easier for authors and users.
Watch whether usage holds after the desktop launch effect fades. The jump from 271,000 to 1.54 million daily users came in about five weeks. A second period of growth, or a plateau, will say more about the product than a single disclosure timed with a community update.
Watch the support programme's terms as well. Token credits are cheap for DeepSeek and useful for testing, but they do not create durable plugin businesses. If popular plugins lose their maintainers, users will feel it through broken updates and abandoned integrations.
Watch the version number too. Harness is still on 0.x releases, and its own repository warns that compatibility will break. Until the plugin API settles, any long-lived workflow built on top of it carries upgrade risk.
Finally, watch how DeepSeek prices the tokens behind Harness. The application is free and open source, while usage flows through a paid API with published per-token rates. Any change to those rates or to caching rules would reshape the economics of running a heavy agent workload.
For now, the numbers establish Harness as a serious alternative to Western agent tools rather than a side project. Bloomberg framed the launch as a challenge to Anthropic and OpenAI. The plugin economy, and the governance around it, will decide how long that challenge lasts.