Cipher — agentic threat model

Not certain from the listing — Cipher acts as an MCP memory tool and does not specify the underlying foundation model used for embeddings or reasoning, but it is highly vulnerable to prompt injection via recalled memories re-entering the prompt.

Cipher relies heavily on vector databases and embeddings for persistent memory. The primary threat is vector database poisoning and embedding inversion, where malicious memories are injected to corrupt the semantic space or exfiltrate sensitive historical context.

As an MCP-based memory framework, it is highly susceptible to memory poisoning. Malicious inputs stored in the vector database are later recalled into the agent's prompt context, leading to indirect prompt injection and hijacking of the orchestration flow.

Not certain from the listing — The deployment architecture (local MCP host vs. cloud vector database) is unspecified, but insecure local MCP daemon configurations or unencrypted vector database connections could expose the memory store to unauthorized local access.

Not certain from the listing — There is no mention of built-in guardrails, memory sanitization, or anomaly detection to flag poisoned memories or unusual retrieval patterns before they are injected back into the agent's context.

Not certain from the listing — The description explicitly flags 'access scoping' as a key security consideration, indicating a lack of robust, built-in multi-tenant isolation or role-based access control (RBAC) for shared team memories.

Highly relevant due to 'shared team workspace memory over MCP'. A single compromised agent can poison the shared memory space, leading to cascading trust abuse and lateral movement/exploitation of all other agents connected to the same workspace.