Filesystem (Reference) — agentic threat model

Not certain from the listing — The reference server is model-agnostic, but the underlying LLM is vulnerable to indirect prompt injection if it reads untrusted files containing malicious instructions via the read tool.

The agent operates directly on local files rather than a vector database. The primary data risk is data poisoning or exfiltration of sensitive files residing within the allowed directory scope.

The core risk lies in tool misuse and insecure tool integration. If the orchestration framework fails to strictly validate paths, directory traversal attacks or unauthorized file writes/deletions can occur.

The agent's security relies heavily on the host environment's sandboxing. If the allowed-directory scope is too broad (e.g., root or user home), a compromise allows lateral movement and host filesystem exposure.

Not certain from the listing — There is no mention of built-in logging, audit trails, or guardrails to detect anomalous file access patterns or malicious payloads being written to disk.

The agent implements basic path-based authorization (scoped allowed-directory access controls), but lacks fine-grained identity management, write-versus-read restrictions, or robust policy enforcement.

In a multi-agent ecosystem, if another compromised agent interacts with this filesystem agent, it can abuse the file-writing tools to plant malicious payloads or read sensitive configuration files.