Tabby — agentic threat model

Not certain from the listing — The specific open-source foundation models used are not detailed. However, these models are susceptible to prompt injection and adversarial manipulation via malicious code comments, potentially leading to the generation of insecure code suggestions.

Tabby operates locally without external databases or cloud services, reducing external data exposure. However, local repository indexing is vulnerable to data poisoning if malicious code is introduced into the scanned codebase, which would then influence future code suggestions.

As a code completion server rather than an autonomous agent, Tabby has a minimal agent framework. The primary risk is insecure integration via its OpenAPI interface, which could be abused to flood the server or extract completion context.

Designed for self-hosting on consumer-grade GPUs. Security relies entirely on the host environment; an exposed or unauthenticated OpenAPI port could allow unauthorized network access to the server, potentially leading to host compromise or source code exposure.

Not certain from the listing — There is no mention of built-in evaluation, logging, or guardrails to detect when the model suggests deprecated, licensing-restricted, or vulnerable code patterns.

Not certain from the listing — The presence of built-in authentication, role-based access control (RBAC), or transport encryption (TLS) for the OpenAPI interface is unspecified, meaning compliance and access controls must be managed externally by the hosting team.

Tabby operates as a standalone self-hosted utility with no multi-agent coordination or marketplace ecosystem, making agent-to-agent trust abuse risks non-existent.