ForeverVM MCP — agentic threat model

Not certain from the listing — ForeverVM is an execution sandbox and MCP tool rather than a foundation model itself, so direct model-level threats like adversarial reprogramming or data poisoning depend entirely on the external LLM orchestrating it.

Not certain from the listing — While the VMs are persistent (implying state and file persistence), the listing does not detail any specific training data, vector databases, or RAG pipelines managed by ForeverVM.

As an MCP tool, it integrates directly into agent frameworks to execute Python code. The primary threat is insecure tool integration where orchestrating agents blindly execute untrusted or malicious code generated by the model.

This is the core layer for ForeverVM. Key threats include sandbox egress, container/host compromise, privilege escalation from the VM to the host, and Denial of Service (DoS) via resource exhaustion within the persistent VMs.

Not certain from the listing — The description mentions resource limits as a control, but does not specify the logging, monitoring, or anomaly detection capabilities used to flag malicious code execution attempts.

The tool explicitly implements sandbox egress controls and resource limits to mitigate arbitrary-code-execution risks, though specific authentication, authorization, and compliance standards (e.g., SOC2) are not detailed.

Designed specifically to run code for other agents. Threats include multi-agent trust abuse, where a compromised agent leverages the persistent VM to store malicious payloads or conduct lateral attacks against other agents sharing the ecosystem.