cc-suite — agentic threat model

Utilizes Claude, Codex, and Gemini. The primary threat is cross-model prompt injection, where an adversarial input designed to exploit one model's weaknesses is propagated to the others through shared session history and delegation.

Reads and shares session histories and uses a single-source AGENTS.md configuration. Threat vectors include session history poisoning, where malicious data injected into one CLI session is read and trusted by another tool, leading to downstream exploitation.

Orchestrates cross-tool delegation and mirrors hooks/MCP servers. This creates a severe risk of insecure tool integration, as a tool or hook configured for one specific CLI's safety boundaries is mirrored and executed by another CLI without equivalent guardrails.

Not certain from the listing — likely runs locally within the developer's terminal/host environment with access to local files and APIs. If unsandboxed, a compromise of the mirrored MCP servers could lead to local privilege escalation or host compromise.

Not certain from the listing — there is no mention of built-in logging, guardrails, or evaluation frameworks to monitor the bidirectional delegation or detect anomalous tool execution across the three CLIs.

Not certain from the listing — no authentication, authorization, or policy enforcement mechanisms are described to govern which agent can delegate tasks or access specific mirrored hooks.

Enables full Claude↔Codex bidirectional delegation. This represents an extreme agent-to-agent (A2A) trust abuse risk, where a compromised or rogue agent session can seamlessly delegate malicious tasks to another agent, bypassing local user confirmation.