GitHub Copilot — agentic threat model
GitHub Copilot presents a moderate agentic risk; while it lacks high autonomy or planning capabilities, its deep integration into developer IDEs and access to local codebases creates a high-impact vector for accidental vulnerability introduction or supply chain poisoning if compromised.
OWASP AIVSS score rationale
| Autonomy of Action | 0.20 | |
| Goal-Driven Planning | 0.30 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.30 | |
| Persistent Memory | 0.20 | |
| Contextual Awareness | 0.70 | |
| Dynamic Identity | 0.10 | |
| Multi-Agent Interactions | 0.10 | |
| Non-Determinism | 0.60 | |
| Opacity & Reflexivity | 0.50 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Utilizes proprietary OpenAI models optimized for code. Primary threats include model poisoning (from malicious public code repositories used during training) and adversarial prompt injection leading to the generation of insecure or backdoored code.
Processes local workspace files and open tabs to build prompt context. Threats include data exfiltration of proprietary intellectual property via telemetry, and local context poisoning where malicious files in a workspace trick the model into generating insecure code.
Not certain from the listing — the orchestration framework managing context assembly and prompt construction is proprietary. Threats include insecure tool integration if the extension attempts to execute local commands, and prompt injection bypassing safety guardrails.
Not certain from the listing — relies on cloud-based inference hosted by GitHub/Microsoft and local IDE extension sandboxing. Threats include compromise of the cloud API endpoints, credential theft from IDE configurations, and insecure local communication channels.
Not certain from the listing — likely utilizes telemetry to monitor suggestion acceptance rates and model drift. Threats include a lack of transparent, real-time security guardrails to block the generation of known vulnerable code patterns before they reach the developer.
Backed by enterprise-grade compliance (e.g., SOC2, ISO) and features filters for public code matching. However, compliance risks remain regarding intellectual property taint and copyleft license violations if the filters fail.
Not certain from the listing — operates primarily as a single-user assistant within the IDE, but potential future integrations with GitHub Actions or other developer-focused agents could introduce cascading trust and authorization risks.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).
These scores are auto-generated from public information (the agent's own listing, docs, and repository) using the canonical OWASP AIVSS formula and the MAESTRO framework — an estimate for guidance, not a penetration test, audit, or certification. See the scoring methodology. Are you the vendor? Factual corrections are free.