Agent Herbie — agentic threat model

Not certain from the listing — The underlying foundation models are not specified. However, because the agent processes incoming emails, it is highly vulnerable to indirect prompt injection attacks embedded in email bodies or attachments, potentially leading to model hijacking or data exfiltration.

The agent integrates with both internal and external data sources to conduct research and analysis. This creates a significant risk of data exfiltration if an attacker can manipulate the agent into sending sensitive internal data via email, or data poisoning if the agent ingests malicious external sources.

The orchestration framework manages email-based task execution, research, and content creation. Insecure tool integration with email clients could allow attackers to trigger unauthorized actions (e.g., sending emails, deleting tasks) via malicious instructions sent to the agent's inbox.

Not certain from the listing — The hosting, sandboxing, and credential storage mechanisms are undisclosed. If email API keys or internal database credentials are not securely isolated, a compromise of the agent's infrastructure could lead to broader credential theft.

Not certain from the listing — There is no mention of logging, guardrails, or evaluation frameworks. The lack of visibility into how the agent processes incoming emails makes it difficult to detect and block prompt injection or anomalous behavior in real-time.

Not certain from the listing — No security certifications (e.g., SOC2), compliance alignments, or explicit access control policies are mentioned, suggesting a lack of formal governance over sensitive executive data.

Not certain from the listing — While the agent interacts with external data sources and email ecosystems, there is no explicit mention of multi-agent coordination or marketplace integrations that would introduce cascading agent-to-agent trust risks.