Windsurf (VS Code extension, formerly Codeium) — agentic threat model

Not certain from the listing — relies on external LLMs (such as Codeium's proprietary models or Claude/GPT-4o) to power Cascade. Threats include prompt injection bypassing system instructions to execute unauthorized local tools.

Operates directly on local codebases, configuration files, and workspace context. High risk of data exfiltration if a compromised MCP server or malicious prompt injection forces the agent to read and transmit sensitive local files.

Cascade orchestrates planning, tool calling, and MCP server integration. The framework supports up to 100 active tools, creating a massive attack surface for insecure tool integration, tool parameter tampering, and indirect prompt injection via codebase files.

Runs locally as a VS Code extension. MCP servers run on the developer's host machine, meaning a compromised tool or malicious MCP server has direct local execution privileges, risking host compromise and lateral movement.

Not certain from the listing — likely relies on standard VS Code extension logging and user-facing chat history. Lacks explicit mention of real-time guardrails or automated anomaly detection for malicious tool execution.

Requires manual configuration of mcp_config.json for custom servers, placing the security burden of credential management and tool authorization entirely on the individual developer.

Features a built-in one-click MCP marketplace. This introduces supply-chain risks where users may install malicious, unverified, or compromised third-party MCP servers that gain immediate access to the local environment.