PiloTY — agentic threat model

Not certain from the listing — PiloTY is an MCP tool/framework rather than a model itself. However, the underlying LLM is highly vulnerable to indirect prompt injection via terminal outputs or SSH banners, which could hijack the active shell session.

Not certain from the listing — No explicit RAG or vector database is described. The primary data risk is the exfiltration of sensitive terminal outputs, configuration files, or environment variables read during SSH/PTY sessions.

The agent framework layer is highly critical here; PiloTY provides stateful PTY and SSH tool integrations. Insecure tool integration or lack of strict input sanitization allows an LLM to execute arbitrary, destructive shell commands or run unauthorized background processes.

Extremely high risk. PiloTY manages SSH connections and interactive terminals. Without strict containerization, network segmentation, and non-root execution, a compromised session allows immediate lateral movement, host compromise, and access to production infrastructure.

Not certain from the listing — There is no mention of built-in logging, session recording, or command guardrails. The lack of real-time monitoring for executed terminal commands represents a major observability blind spot.

The tool handles high-privilege SSH credentials and session states. The listing does not mention any built-in authentication, authorization policies, or access controls to restrict which commands the agent can execute or which hosts it can connect to.

As an MCP tool, PiloTY can be exposed to other agents. If a upstream orchestrator agent is compromised, it can abuse PiloTY's terminal access to execute cascading attacks across all connected remote hosts.