Capability Overview
FableCut is an open-source, zero-dependency, browser-based non-linear video editor explicitly designed to be driven by AI agents. Its core architectural decision — exposing the entire editing timeline as a single JSON document — and its dual control interfaces (MCP server and REST API) mean that any compatible AI agent, including Claude Code and Claude Desktop, can read, modify, and trigger exports of video projects programmatically and in real time. The live-reloading UI makes agent activity immediately visible to a human operator, but critically, it does not enforce that a human must approve each operation.
For defenders, this represents a new class of AI-adjacent attack surface: an agentic tool-use endpoint sitting directly on top of a media production pipeline, with no authentication layer described in the public repository.
Attack Surface Analysis
Unauthenticated API exposure. The REST and MCP servers are described as zero-dependency and locally hosted. In practice, teams frequently expose such servers on LAN segments, internal cloud networks, or behind misconfigured proxies. Without explicit authZ controls, any agent — or any attacker with network access — can issue timeline edits or trigger exports.
JSON timeline as an adversarial surface. The timeline document is the single source of truth for the edited video. An attacker or compromised agent that can write to this document controls what gets exported. This could be used to silently insert, remove, or replace media segments — including swapping legitimate footage for synthetic or manipulated content — in workflows where the exported file is trusted downstream.
Prompt injection via media content. If an AI agent is instructed to summarise, caption, or analyse video content before editing, adversarially crafted subtitles, embedded metadata, or on-screen text within source media could inject instructions that redirect the agent’s subsequent MCP/REST calls.
Excessive agency. The design explicitly enables agents to complete full edit-to-export cycles autonomously. Without mandatory human-in-the-loop checkpoints, a prompt-injected or misconfigured agent can silently alter and export a final video artefact.
Supply chain risk. The zero-dependency, self-hosted model means operators are fully responsible for their own hardening. There is no managed service layer applying updates or security controls, and the open-source nature means forks may ship without even the minimal security guidance in the upstream SECURITY.md.
Framework Mapping
- AML.T0051 / LLM01 (Prompt Injection): Indirect injection via media file content targeting the driving AI agent is a realistic vector.
- LLM08 (Excessive Agency) / AML.T0047: The agent is granted write access to a production artefact pipeline with no described confirmation requirement.
- LLM07 (Insecure Plugin Design): The MCP server functions as an LLM plugin with broad tool-use scope and no documented authZ.
- AML.T0043 (Craft Adversarial Data): Manipulated JSON timelines or source media can be used to influence exported content.
- LLM05 (Supply Chain Vulnerabilities): Self-hosted, zero-dependency deployment shifts all security responsibility to the operator.
Threat Scenarios
Scenario 1 — Insider media tampering. A malicious insider with access to an AI agent connected to FableCut issues REST calls to swap out approved footage with manipulated content immediately before export, with no approval gate to block the action.
Scenario 2 — Prompt injection via subtitle file. A video file with adversarially crafted subtitle text instructs the agent to issue a REST command that exports a version of the timeline containing a hidden segment, or exfiltrates the timeline JSON to an attacker-controlled endpoint.
Scenario 3 — Exposed REST server on LAN. A developer runs FableCut locally without authentication on a shared corporate network. An attacker on the same network discovers the open port and directly modifies the JSON timeline to inject content into a video destined for public release.
Defender Checklist
- Require authentication (at minimum API key; ideally OAuth) on both the REST and MCP server before any agent integration
- Run FableCut on localhost-only or an isolated network segment; never expose the REST port to untrusted networks
- Implement a human approval step before any agent-triggered export action
- Validate and integrity-sign the JSON timeline document before final export; compare against a known-good baseline
- Treat all source media metadata and subtitle content as untrusted input when an AI agent is in the editing loop
- Review agent permission scopes — restrict MCP tool access to read-only where full edit rights are not required
- Monitor REST/MCP server logs for unexpected timeline mutations or export calls outside of normal operator sessions