Rasa — agentic threat model

Rasa utilizes intent classifiers, entity extractors, and increasingly LLMs for dialogue management. Threats include adversarial inputs designed to bypass intent classification or prompt injection attacks if LLM-based policies (like Rasa Calm) are used.

Rasa relies on structured training data (YAML format) and stores conversation history in Tracker Stores (SQL, Redis, MongoDB). Threats include training data poisoning and unauthorized access or exfiltration of sensitive PII stored in conversation logs.

The framework orchestrates dialogue via policies and executes 'Custom Actions' (arbitrary Python code). Insecure custom action code can lead to vulnerabilities like SSRF, SQL injection, or remote code execution if user inputs are unsafely processed.

Not certain from the listing — Rasa is typically self-hosted via Docker or Kubernetes. Infrastructure threats include exposed Rasa server ports (default 5005) without token authentication, container escape, and insecure secrets management for external APIs.

Rasa provides command-line testing tools and event brokers for telemetry. Gaps in real-time observability can lead to undetected model drift, evasion attacks, or failure to log malicious payloads sent by attackers.

Rasa supports token-based authentication and SSL/TLS. However, compliance and access control policies (like RBAC) must be manually configured and enforced, especially when deploying the open-source version.

Not certain from the listing — Rasa primarily operates as a single-agent conversational interface but connects to external messaging channels (Slack, MS Teams). Threats include channel spoofing, API credential theft, and unauthorized downstream action execution.