Supermaven — agentic threat model
Supermaven presents a moderate-to-high risk profile primarily due to its deep integration into developer IDEs and access to up to 1 million tokens of local codebase context. While its autonomy is low (requiring developer acceptance of suggestions), a compromise or prompt injection attack could lead to proprietary code exfiltration or the silent introduction of security vulnerabilities.
OWASP AIVSS score rationale
| Autonomy of Action | 0.20 | |
| Goal-Driven Planning | 0.20 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.20 | |
| Persistent Memory | 0.30 | |
| Contextual Awareness | 0.80 | |
| Dynamic Identity | 0.10 | |
| Multi-Agent Interactions | 0.10 | |
| Non-Determinism | 0.50 | |
| Opacity & Reflexivity | 0.60 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — Supermaven uses a custom, highly optimized model for fast code completion and sequence analysis. Threats include model reprogramming or prompt injection via malicious code comments in the workspace that manipulate the model's output.
The agent processes massive amounts of local workspace data (up to 1M tokens) and edit history. Threats include data exfiltration of proprietary source code or intellectual property, and poisoning of the context if malicious files are introduced to the workspace.
Not certain from the listing — The orchestration layer manages the edit sequence analysis and IDE state. Threats include insecure integration with the IDE API, allowing unauthorized file reads or command execution if the framework is exploited.
Not certain from the listing — The model likely runs on Supermaven's cloud servers to support the 1M token window. Threats include insecure transit of codebase data to the cloud, lack of tenant isolation on the backend, or compromise of the cloud API.
Not certain from the listing — No details are provided on guardrails or monitoring of generated code for security vulnerabilities (e.g., CWEs) before presenting suggestions to the user.
Not certain from the listing — No mention of compliance certifications (SOC2, ISO 27001) or enterprise access controls for managing code telemetry and privacy.
Not certain from the listing — No multi-agent or marketplace interactions are described; it operates as a standalone IDE extension.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).
These scores are auto-generated from public information (the agent's own listing, docs, and repository) using the canonical OWASP AIVSS formula and the MAESTRO framework — an estimate for guidance, not a penetration test, audit, or certification. See the scoring methodology. Are you the vendor? Factual corrections are free.