AIlice — agentic threat model

Uses open-source LLMs as a 'core processor' or 'text computer'. This makes the entire system highly susceptible to prompt injection, adversarial reprogramming, and misaligned outputs, which can directly translate into malicious system commands.

Not certain from the listing — the description mentions thematic research and literature reviews, implying it accesses external documents or web search, but specific vector stores or RAG pipelines are not detailed, posing potential data poisoning or exfiltration risks if untrusted sources are ingested.

Employs an advanced orchestration framework capable of 'self-construction of modules' and 'system management'. This introduces severe risks of insecure tool creation, tool misuse, and arbitrary code execution if the LLM planner is hijacked.

Not certain from the listing — as a standalone open-source assistant doing 'system management', it likely runs directly on the user's host OS. Without explicit sandboxing or containerization mentioned, this poses extreme risks of host compromise and privilege escalation.

Not certain from the listing — there is no mention of built-in guardrails, evaluation frameworks, or logging mechanisms to monitor the 'text computer' execution, creating significant blind spots.

Not certain from the listing — being a free, open-source personal assistant, it lacks formal compliance certifications (like SOC2 or ISO) or built-in enterprise access controls, relying entirely on the deployment environment's security.

Not certain from the listing — while it acts as a JARVIS-like assistant, there is no explicit mention of multi-agent marketplace interactions or coordination protocols, though its self-constructed modules could interact with external APIs.