Coder — agentic threat model

Not certain from the listing — Coder acts as an infrastructure and MCP orchestration layer rather than providing the underlying LLMs. The model layer remains vulnerable to prompt injection, which could be leveraged to execute unauthorized shell commands or manipulate Terraform variables.

Not certain from the listing — The platform manages workspace templates and environment variables, but specific RAG or vector database integrations are not detailed. The primary data risk is the exposure of secrets, environment variables, and source code stored within the provisioned workspaces.

Coder exposes an MCP (Model Context Protocol) surface allowing agents to provision and operate workspaces. The primary threat is tool misuse, where an agent is manipulated into executing destructive Terraform plans or running malicious shell commands within the workspace.

This is Coder's core surface. It uses Terraform-defined, isolated cloud development environments to sandbox agent execution. Threats include container escapes, lateral movement to the self-hosted control plane, and unauthorized access to the host network if the workspace boundaries are misconfigured.

Not certain from the listing — While Coder manages workspace state and connection logs, the listing does not detail active guardrails, real-time prompt monitoring, or agent-specific anomaly detection systems to intercept malicious commands.

Coder relies on a self-hosted control plane, template-level permissions, and secrets handling to enforce boundaries. Security depends on strict role-based access control (RBAC) to prevent agents from accessing templates or credentials outside their authorized scope.

The MCP integration allows external agents to interact with Coder workspaces. This introduces risks of agent-to-agent trust abuse, where a compromised external agent could exploit the workspace provisioning API to spin up unauthorized, costly, or malicious infrastructure.