Executive brief
Cochise is an open-source LLM-driven penetration testing agent that connects to target machines via SSH. The tool disables SSH host key verification, allowing attackers to perform man-in-the-middle attacks or connect to attacker-controlled servers without any warning. Combined with insufficient sanitization of SSH command output, an attacker can inject malicious instructions into the tool's command pipeline, leading to remote code execution on the target machine.
Technical details
The vulnerability stems from improper certificate validation in the SSH connection handler (src/cochise/ssh/ssh_connection.py). The asyncssh.connect function is called with known_hosts=None, which explicitly disables host key verification against a trusted known_hosts file. This allows man-in-the-middle attacks and connections to attacker-controlled SSH servers. Combined with unsanitized output handling in the LLM context (src/cochise/agent/executor.py), where raw SSH command output is appended directly to conversation history without filtering or taint marking, an attacker can inject prompt-injection payloads. When the LLM processes this untrusted input as contextual data, it may generate and execute malicious commands. The attack requires network positioning (for MITM) or control of a target machine that Cochise connects to, but no authentication is required. Patching requires enabling host key verification and implementing output sanitization.
Affected products
- andreashappe cochise up to 0.4.1
Timeline
- 2026-09-14: disclosed
- 2026-08-04: advisory: GitHub issue #13 opened reporting host key verification disabled and unsanitized target output