Local Models and Tool Permissions
Part 7 of Oracles, Traces, Triage.
After getting the local models running, I tested their input limits. Those checks were requests to an inference server: text went in and an answer came back. The testing agents from the earlier parts of this series would do more with that answer. They would use it to decide which files to read, which commands to run, and what to investigate next.
While choosing the models, I kept coming back to a concern about the community-modified weights. Could a model emit a tool call asking my agent to scan the drive and upload what it found? Would using an original upstream model, or a different runtime, make that safe?
Running inference locally keeps the prompt processing on my machine. It doesn’t stop a model from proposing an upload, and it doesn’t stop an agent with broad permissions from carrying one out. That applies to an upstream model too. I need to consider both the software I’m loading and the permissions of the program acting on its output.
For the repository work I’ve described in this series, access to a compiler, a checkout, and test results is useful. Access to unrelated files in my home directory usually isn’t. The local installation is a good point to make those choices explicit, before attaching the tools.
Start with what executes
A model installation contains more than weights. It can include model implementation code, tokenizer and processor code, a chat template, native libraries, a Python environment, and an HTTP server. Some of these execute directly. Others supply data to code that executes.
Custom model code can have an ordinary purpose: implementing an architecture that the installed library does not support yet. Its presence does not establish malicious behavior. It does add code to the review and pinning problem. Hugging Face’s custom-model documentation describes this extension mechanism and the explicit trust involved in loading custom code.
File formats matter too. Pickle-based loading can execute code during deserialization; Hugging Face documents that risk in its pickle-scanning guidance. A tensor-oriented format avoids that particular mechanism. It does not prove that a parser is free of bugs, that the surrounding package is benign, or that the generated text is safe to act on.
I therefore recorded the components together:
weights + model code + runtime + template + server configuration
That includes the separate native runtime needed by Orca GLM, as well as the model files. Revisions and hashes let me identify what I used and notice changes later. They don’t establish that the software is benign; the generation tests weren’t a security audit.
Then follow the tool call
Consider the path from a response to a side effect:
model output
|
v
tool-call parser
|
v
permission checks
|
v
tool process ----> filesystem / subprocesses / network
The model can propose a filesystem search. The parser can recognize it as a valid tool request. Neither fact should authorize the search.
The same applies to uploads. A syntactically valid HTTP tool call can still name an unapproved destination or contain data the process should never have read. Giving a model a narrower system prompt does not remove those capabilities from the process that executes its instructions.
For a repository investigation, I would make the checked-out repository and an output directory available, keep unrelated home-directory data out of the sandbox, and restrict network access at the execution boundary. The specific permissions depend on the task. The important property is that they are enforced outside the generated response.
This is a design requirement for the agent harness. The inference tests described in these articles did not validate a complete sandbox or an exfiltration-resistant worker.
Upstream provenance helps, within its scope
Using an upstream checkpoint can remove uncertainty about changes made by another distributor. It does not remove the need to review the runtime or constrain the agent. An upstream model can also produce an unsafe tool request, misunderstand the task, or follow instructions found in a file.
Similarly, switching from MLX-VLM to MLX-LM would change part of the software stack. It would not by itself make the model’s tool requests trustworthy. I would still need to establish compatibility, inspect the loaded implementation, and test the resulting service.
The word “uncensored” in an artifact name describes a publisher’s positioning. It is not evidence about the absence or presence of a backdoor. I had no finding that the Orca artifacts were malicious.
Accessing the server from another device
I also wanted to send requests from other devices, including my phone through a router running Tailscale. That raised a different access question: who could reach the model server?
With the service bound to loopback, an SSH tunnel can carry requests from another machine. With a wildcard bind, the service can accept connections through the machine’s network interfaces, subject to routing and firewall rules. The tested servers did not provide API authentication.
For an already configured SSH host alias named inference-mac, a tunnel
can look like this:
ssh -N -o ExitOnForwardFailure=yes \
-L 127.0.0.1:18000:127.0.0.1:8000 inference-mac
The client then talks to http://127.0.0.1:18000/v1. The explicit local
bind keeps this forwarded port on the client’s loopback interface. These
are the ordinary OpenSSH local-forwarding semantics. SSH access
must already be configured and its host key verified.
For direct LAN access I added macOS application-firewall exceptions manually. The installer deliberately left that decision to the operator. Apple’s firewall controls allow incoming connections by application; those exceptions should not be confused with a rule allowing only one source address to one model port.
After the M5 restore, a request from another machine returned the model listing on port 8000. That established remote HTTP reachability. The local probe had already established generation. I haven’t yet tested the phone’s route through the Tailscale router.
For a future investigation, I would start by restricting the agent to its checkout, working directory, and approved tools and destinations. Choosing a model or changing the server doesn’t do that work for me.
The restore scripts preserve the model settings but leave firewall changes to the operator. In the next post, I describe what they do restore, and what happened when I tried them after resetting the M5.
Retrospective entry for October 22. Assembled October 24, including the subsequent M5 LAN check.