Box — agentic threat model

Not certain from the listing — The specific underlying LLM powering Box AI is not disclosed. The primary threat is indirect prompt injection where adversarial text embedded within indexed Box documents hijacks the model's instructions during analysis.

The agent directly queries the Box Intelligent Content Management platform. The primary risk is data exfiltration or unauthorized access if read scopes are overly broad, alongside potential knowledge-base poisoning if malicious users upload documents designed to corrupt search results.

The agent uses the Model Context Protocol (MCP) to expose search, read, and analysis tools. Insecure tool integration could allow an attacker to manipulate tool arguments (e.g., path traversal or search query injection) to access unauthorized files.

Not certain from the listing — The hosting environment of the MCP server and the sandboxing of the document parser are unspecified. Vulnerabilities in document parsing libraries (e.g., PDF/Office parsers) could lead to remote code execution on the host.

Not certain from the listing — It is unclear what guardrails or logging mechanisms are in place to monitor Box AI queries, detect anomalous document access patterns, or intercept prompt injection attempts.

Backed by Box OAuth, which provides strong identity and authorization boundaries. However, if the OAuth token is granted excessive read scopes, the agent inherits those privileges, potentially exposing sensitive enterprise files to unauthorized users.

As an MCP tool, this agent is designed to be called by other host agents. This introduces cascading risks where a compromised orchestrator agent could abuse the Box tool to systematically harvest or exfiltrate corporate data.