Thermos — agentic threat model

Not certain from the listing — The specific foundation models used by this Cursor plugin are not disclosed. Threats include prompt injection via malicious code comments in audited branches, which could manipulate the audit results or hijack subagent orchestration.

Not certain from the listing — The data operations layer is not detailed, but the agent clones and reads local/remote code branches. Threats include data exfiltration of proprietary source code during the audit process.

The agent framework orchestrates parallel subagents and uses tools to clone repositories and create PRs. Threats include tool misuse, such as unauthorized PR creation or injecting malicious code into a branch under the guise of a 'fix'.

Not certain from the listing — As a Cursor plugin, it likely runs locally on the developer's machine or within Cursor's cloud environment. Threats include local privilege escalation, host compromise if subagents execute arbitrary code, and exposure of local Git credentials.

Not certain from the listing — No observability or evaluation guardrails are mentioned. Gaps in logging could allow malicious subagent actions or unauthorized PR creations to go undetected.

Not certain from the listing — There is no mention of access control policies, compliance frameworks, or authorization checks before creating merge-ready PRs.

The agent relies heavily on parallel subagent orchestration. Threats include agent-to-agent trust abuse, where a compromised subagent feeds malicious audit data back to the parent agent, leading to cascading failures or compromised code generation.