ml-research — agentic threat model

Runs on the user's Claude Code subscription. The primary L1 threats include prompt injection bypassing the budget boundaries of the autonomous loop, or adversarial manipulation of the fine-tuning process (SFT/DPO/GRPO) leading to model reprogramming or mis-aligned outputs in the target models being trained.

Handles dataset, repository, and paper tooling. Highly vulnerable to data poisoning where malicious training datasets are ingested, or data exfiltration of proprietary training data and model weights via the Hugging Face Jobs integration.

Bundles 2 skills, 2 agents, and 1 hook to orchestrate the ML engineering workflow. Threat of tool misuse is high, as the autonomous experiment loop can be hijacked to execute arbitrary training configurations or consume excessive compute budgets.

Executes fine-tuning jobs remotely on Hugging Face Jobs and runs locally via Claude Code. Threats include credential theft (Hugging Face API tokens, Claude Code session keys) and potential container escape or unauthorized resource consumption on the remote HF Jobs infrastructure.

Not certain from the listing — relies on Claude Code's native logging and the agent's internal budget-bounding logic. There is a risk of evaluation gaming or blind spots if the autonomous loop fails to report anomalous training runs or budget overruns.

Not certain from the listing — security controls appear limited to the 'budget-bounded' constraint. Lacks explicit mention of enterprise-grade access controls, audit logging, or compliance certifications for the orchestrated training environments.

Bundles 2 internal agents to coordinate tasks. Threats include cascading failures or trust abuse between the internal agents during the autonomous experiment sweep, potentially leading to runaway resource allocation.