# Supply Chain symbio-cli PyPI Package Acquisition

- **Severity:** Medium
- **Signature ID:** `6f2b9c41-8d3e-4a17-9b0c-5e7d2a84f1c3`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM03 (Supply Chain)

## Summary

This rule flags when someone installs or runs a package called symbio-cli, which describes itself as an autonomous, self-finetuning local AI agent. It does not mean the package is malicious — no malware or exploit has been found in it — it simply tells you an unreviewed autonomous-agent tool has shown up on a machine so someone can look at it.

## How the attack works

An engineer or a script runs a command like 'pip install symbio-cli' or executes the tool's console entrypoint on an endpoint. The rule watches process-execution activity for the literal package name (including its normalized spellings symbio_cli and symbio.cli) appearing on the command line. If found, it reports the event as an informational finding, not a block. Installs done indirectly through a requirements.txt, poetry.lock, pyproject.toml, or a private package mirror will not show the name on the command line and are not caught.

## Why it matters

If organizations don't know an autonomous agent package has been installed, they can't assess what data or systems it can reach, or whether it phones home, self-modifies, or acts without supervision. The main loss here is visibility, not confirmed compromise — unreviewed autonomous-agent software could gain a foothold before anyone notices.

## What you can do

- Treat any report of this package as a prompt to inventory where it was installed and by whom, then review its behavior before letting it run further.
- If your team intends to use symbio-cli, do so in an isolated sandbox or scratch environment, not on production or sensitive endpoints.
- Add an internal allow-list or suppression entry once a package is formally reviewed and approved, so future installs don't generate redundant noise.
- Restrict which endpoints can run arbitrary pip installs, and require dependency manifests (requirements.txt/poetry.lock) to go through review, since those installs won't be visible to this kind of command-line-based detection.

## Known benign look-alikes

- An ML engineer or researcher deliberately evaluating symbio-cli in a sandbox or scratch virtualenv. This is the single most common expected match, and is exactly why the rule reports rather than blocks.
- A security analyst detonating or reverse-engineering the package as part of the review this intelligence entry is asking for. Wrapper invocations via pip-audit / safety / trivy / syft are filtered, but a plain 'pip install symbio-cli' inside an analysis VM will still be reported.
- A CI or provisioning job that installs the package after an internal approval decision has already been taken; the report becomes redundant noise until an allow rule is placed ahead of this one by the operator.
- A sibling distribution sharing the namespace prefix, e.g. 'pip install symbio-cli-plugin', matches because the word boundary after 'cli' is satisfied by the hyphen. Treated as in-scope for review rather than tightened away.
- Copy-pasted tutorial or README command lines executed for a demo. These are genuine executions and are intentionally not suppressed.

## References

- https://pypi.org/project/symbio-cli/
- https://owasp.org/www-project-top-10-for-large-language-model-applications/

---
Source: https://www.netzilo.com/threats/symbio-cli-pypi-acquisition