Kosmos — agentic threat model

Not certain from the listing — The listing does not specify the exact foundation models used, though it mentions supporting multiple model providers for self-hosting. Threats include adversarial prompt injection influencing hypothesis generation or model reprogramming during literature analysis.

Ingests large datasets (omics, genetics, materials science) and reads ~1,500 papers per run. High risk of data poisoning (malicious literature or poisoned datasets leading to toxic/dangerous chemical/biological hypotheses) and data exfiltration of proprietary research.

Uses a structured world model to coordinate agents and orchestrate multi-agent workflows. Executes tens of thousands of lines of code (data analysis pipelines). High risk of arbitrary code execution (ACE) vulnerabilities if the code execution environment is not strictly sandboxed, and memory poisoning within the world model.

Not certain from the listing — Hosted on the Edison Scientific platform or self-hosted via GitHub. If self-hosted, infrastructure security depends on the user, but the execution of tens of thousands of lines of generated code requires robust containerization/sandboxing to prevent host compromise or lateral movement.

Synthesizes fully cited scientific reports traceable to code cells or primary literature. However, long 12-hour autonomous runs present massive observability challenges; detecting drift, logic loops, or malicious code execution mid-run is difficult without real-time telemetry.

Not certain from the listing — No specific compliance certifications (like SOC2, HIPAA, or ISO) or identity/access management controls are detailed in the listing, despite handling sensitive healthcare, genetic, and pharmaceutical data.

Features multi-agent orchestration using a structured world model. Risks include cascading failures across orchestrated agents, trust abuse between the coordinator and worker agents, and propagation of malicious instructions across the agent network.