Aider Composer — agentic threat model

Not certain from the listing — The agent relies on external LLMs configured by the user via the Aider backend. It is highly vulnerable to indirect prompt injection if malicious code or files are loaded into the workspace, potentially forcing the model to generate backdoored code or execute arbitrary commands.

The agent reads the local workspace to build context for the LLM. If the workspace contains sensitive files, API keys, or configuration files, these can be exfiltrated to the configured LLM provider during normal context assembly.

The orchestration framework (Aider engine) plans and applies edits directly to the local filesystem and automatically creates git commits. A compromised planning loop or malicious tool call could result in unauthorized file deletion, modification, or execution of arbitrary shell commands.

Runs locally as a VS Code extension and Python backend. It inherits the user's local privileges and lacks sandboxing, meaning any compromise of the backend can lead to full host compromise and lateral movement within the user's network.

Not certain from the listing — The UI provides a diff review for inline edits, which acts as a manual human-in-the-loop guardrail, but there is no mention of automated security scanning, logging, or guardrails to detect malicious code generation before application.

Not certain from the listing — There are no built-in compliance policies, access controls, or audit trails mentioned beyond standard git commit history, leaving security policy enforcement entirely up to the end-user.

Not certain from the listing — The agent operates primarily as a single-user developer tool within VS Code and does not explicitly interact with external multi-agent ecosystems or marketplaces, minimizing direct agent-to-agent trust risks.