Threat Model¶

This document describes the threats Missy's security architecture is designed to address, the mitigations in place, and the known limitations of the current design.

Scope¶

Missy is a self-hosted local AI agent running on a Linux machine under a single user account. The threat model assumes:

• Trusted operator: The person who installs and configures Missy is trusted.
• Untrusted inputs: User prompts, tool outputs, MCP server responses, file contents, and webhook payloads are all treated as potentially adversarial.
• Trusted code: The Missy codebase itself is assumed uncompromised. Supply chain attacks against Missy's dependencies are out of scope (mitigate with standard practices: pinned dependencies, hash verification).

Threats Addressed¶

T1: Prompt Injection¶

Attack: An adversary embeds instructions in user input, tool output, or retrieved documents that cause the agent to perform unintended actions.

Mitigations:

T2: Secret Exfiltration¶

Attack: The agent inadvertently includes credentials in a response, log entry, or outbound API call.

Mitigations:

T3: Server-Side Request Forgery (SSRF)¶

Attack: The agent is tricked into making HTTP requests to internal services, cloud metadata endpoints (169.254.169.254), or other unintended destinations.

Mitigations:

graph TD
    A["Agent: fetch https://evil.com/api"] --> B[PolicyHTTPClient]
    B --> C{Host in allowlist?}
    C -->|No| D[BLOCKED: PolicyViolationError]
    C -->|Yes| E[DNS Resolution]
    E --> F{Any IP private/reserved?}
    F -->|"Yes, not in allowed_cidrs"| G["BLOCKED: DNS rebinding"]
    F -->|No or explicitly allowed| H[Request proceeds]
    H --> I{Redirect response?}
    I -->|Yes| J["BLOCKED: redirects disabled"]
    I -->|No| K[Response returned]

T4: Command Injection¶

Attack: The agent is tricked into executing arbitrary shell commands, either through direct injection or by chaining allowed commands with shell metacharacters.

Mitigations:

T5: MCP Supply Chain Attack¶

Attack: A compromised or malicious MCP server returns tool definitions or results containing injection payloads, exfiltration attempts, or commands designed to abuse the agent's capabilities.

Mitigations:

T6: Filesystem Traversal¶

Attack: The agent is tricked into reading or writing files outside allowed directories, potentially accessing /etc/shadow, SSH keys, or other sensitive files.

Mitigations:

T7: Resource Exhaustion¶

Attack: A malicious input, tool, or server attempts to exhaust memory, disk, connections, or API budget.

Mitigations:

T8: Credential Stuffing via Config¶

Attack: Plaintext API keys in config.yaml are leaked through backups, version control, or file sharing.

Mitigations:

Threats NOT Addressed¶

The following threats are outside Missy's security scope:

Physical Access¶

If an attacker has physical access to the machine or root access to the OS, Missy's security controls can be bypassed by reading process memory, modifying the binary, or accessing the vault key file directly.

Kernel and OS Exploits¶

Missy runs as a userspace process. Kernel vulnerabilities, container escapes, or OS-level privilege escalation are not mitigated by Missy.

Compromised Dependencies¶

If a Python dependency (httpx, cryptography, pyyaml, etc.) is compromised at the package level, malicious code could bypass Missy's controls. Mitigate with:

• Pinned dependency versions in pyproject.toml
• Hash verification via pip install --require-hashes
• Regular dependency audits

Side-Channel Attacks¶

Timing attacks against the policy engine, cache-based side channels, and electromagnetic emanations are not addressed.

Model-Level Attacks¶

Missy cannot prevent the underlying LLM from:

• Generating harmful content within its capability window
• Being influenced by training data poisoning
• Exhibiting emergent behaviors not anticipated by the sanitizer

The policy engine limits what the agent can do with generated content, but not what it generates.

Network-Level Attacks¶

Man-in-the-middle attacks on HTTPS connections, BGP hijacking, and DNS spoofing at the resolver level are outside scope. Missy relies on the OS TLS stack and DNS resolver.

Denial of Service Against Missy¶

A local user or process can deny service to Missy by killing the process, filling the disk, or exhausting system resources. Missy does not defend against attacks from other processes on the same machine.

Security Boundaries Summary¶

graph TB
    subgraph "Missy Controls (Inside Boundary)"
        A[Agent behavior]
        B[Outbound HTTP]
        C[File access]
        D[Shell execution]
        E[Secret storage]
        F[Audit logging]
    end

    subgraph "Outside Boundary"
        G[OS kernel]
        H[Other processes]
        I[Physical access]
        J[Network infrastructure]
        K[Dependency supply chain]
        L[LLM training data]
    end

    A -.->|"Policy Engine"| B
    A -.->|"Policy Engine"| C
    A -.->|"Policy Engine"| D
    A -.->|"Vault"| E
    A -.->|"AuditLogger"| F

Reporting Security Issues¶

If you discover a security vulnerability in Missy, please report it responsibly. Do not open a public GitHub issue. Contact the maintainers directly via the information in the repository's security policy.