Beads — agentic threat model

Not certain from the listing — Beads is model-agnostic and acts as an MCP tool; however, the downstream LLM is highly vulnerable to indirect prompt injection and behavioral reprogramming if it consumes poisoned memory beads from the store.

Beads acts as a specialized data store. The primary threat is knowledge-base and memory poisoning, where malicious or corrupted data is committed to the Git-backed store and subsequently loaded into the agent's context window.

This is the core layer for Beads. It provides structured memory records over MCP. The main threat is memory poisoning and insecure tool integration, as agents can read/write arbitrary content that persists across sessions without input sanitization.

The memory store is Git-backed. Infrastructure threats include unauthorized access to the Git repository, lack of transport security for the MCP connection, and potential credential exposure if Git SSH keys or tokens are poorly managed.

Not certain from the listing — there is no mention of built-in guardrails, anomaly detection, or validation schemas to detect when a memory bead contains malicious payloads or prompt injections.

Not certain from the listing — access control relies entirely on the underlying Git repository's permissions. There is no native authentication or fine-grained authorization policy defined within the Beads protocol itself.

Because Beads is designed for cross-session and potentially cross-agent memory, a compromised agent can write poisoned memories to the shared Git store, leading to cascading failures and horizontal privilege escalation across the agent ecosystem.