Agent E — agentic threat model

Not certain from the listing — Agent-E runs locally but the underlying foundation models (e.g., proprietary APIs or local LLMs) are not specified. Threats include adversarial prompt injection via untrusted web pages it navigates, leading to model reprogramming or misaligned outputs.

Not certain from the listing — The exact storage mechanism for its long-term memory or local vector stores is not detailed. Threats include memory poisoning from malicious web content and data exfiltration of sensitive browser data.

Agent-E uses a custom hierarchical framework with a Planner and Executor. Vulnerabilities include tool misuse (browser automation), insecure tool integration (direct browser control), and prompt injection bypassing the Planner's constraints.

Runs locally on the user's machine and interacts directly with the user's browser. This presents high risks of local privilege escalation, host compromise, and unauthorized access to local files or active browser sessions/cookies.

Not certain from the listing — No runtime observability, guardrails, or logging mechanisms are described. This creates blind spots where malicious browser actions could occur undetected.

Not certain from the listing — There is no mention of security policies, authentication controls, or compliance frameworks. Operating locally on a user's browser without explicit authorization boundaries poses significant compliance and privacy risks.

Employs an internal multi-agent system (Planner and Executor). Risks include cascading failures if the Planner is deceived by web content, leading it to issue malicious instructions to the Executor.