PC Agent — agentic threat model

Not certain from the listing — The listing does not specify the exact foundation models used for the planning and grounding agents, but they are highly susceptible to prompt injection, adversarial visual inputs (targeting the visual grounding agent), and model reprogramming.

The PC Tracker collects large-scale human-computer interaction data, and the Cognition Completion pipeline processes it. This introduces severe risks of data poisoning within the interaction logs, as well as the accidental exposure or exfiltration of sensitive user data (such as PII or credentials) captured during tracking.

The framework orchestrates a planning agent and a grounding agent to execute tasks. Vulnerabilities include insecure tool execution on the host OS, planning bypasses via adversarial UI states, and manipulation of the cognitive trajectories generated by the post-processing pipeline.

Not certain from the listing — The hosting and sandboxing environment for running these digital agents is not detailed, posing extreme risks of host compromise, privilege escalation, and lack of isolation if the agent executes actions directly on a user's operating system without a secure container.

Not certain from the listing — While the PC Tracker and Cognition Completion pipeline provide observability into interaction data, there is no mention of real-time security monitoring, policy guardrails, or anomaly detection to intercept malicious agent behavior.

Not certain from the listing — As an open-source research framework, there are no documented access controls, authentication mechanisms, or compliance alignments (such as NIST or EU AI Act) for managing agent permissions and data privacy.

The system natively uses a multi-agent architecture combining a planning agent and a grounding agent. Threats include cascading failures if the grounding agent misinterprets the UI, or trust abuse between the planning and grounding components leading to unintended OS-level actions.