subagent-driven-development — agentic threat model

Not certain from the listing — The listing does not specify which foundation models are used to power the main agent or the spawned subagents, making it susceptible to model-specific adversarial prompt injection or reprogramming that could alter the generated code.

Not certain from the listing — The listing does not detail how the codebase or repository data is ingested, stored, or vectorized, posing potential risks of data exfiltration or codebase leakage if the context window contains sensitive secrets.

The framework orchestrates planning, dispatches subagents, and performs reviews. Vulnerabilities include insecure tool integration (code mutation tools) and planning manipulation where a subagent is tricked into executing malicious tasks.

Not certain from the listing — The hosting environment (e.g., local, containerized, or cloud runner) is not specified, but the code-mutation and agent-spawning capabilities present a severe risk of container escape or host compromise if not strictly sandboxed.

The agent implements 'per-task spec + quality review' and a 'whole-branch final review'. While these act as quality guardrails, they may have blind spots or be bypassed by sophisticated adversarial subagents (evaluation gaming).

Not certain from the listing — There is no mention of identity management, authorization policies, or audit logging for the spawned subagents, raising compliance and accountability concerns regarding who authorized specific code mutations.

The core design relies on spawning multiple isolated-context subagents. This introduces significant multi-agent risks, such as cascading failures, agent-to-agent trust abuse, and the potential for a compromised subagent to inject malicious code that evades the final branch review.