ClearWork Discovery Agent — agentic threat model

Not certain from the listing — likely relies on commercial LLMs for document analysis and conversational interview generation. Threats include prompt injection via ingested documents or user interview responses, which could hijack the agent's logic or cause misaligned outputs.

Ingests existing documentation, process descriptions, and builds a persistent knowledge graph. This creates significant exposure to data poisoning (maliciously formatted documents corrupting the graph) and unauthorized data exfiltration of sensitive corporate IP.

Orchestrates document ingestion, gap identification, and interview execution. Vulnerabilities include insecure tool integration with the knowledge graph database and potential manipulation of the interview planning logic via adversarial inputs.

Not certain from the listing — likely hosted as a closed-source SaaS. Threats include insecure storage of ingested corporate documents, lack of tenant isolation, and potential privilege escalation if the hosting environment is compromised.

Not certain from the listing — no mention of monitoring, guardrails, or evaluation frameworks. This creates risks of conversational drift during automated interviews and undetected hallucinations in the final current state analysis.

Not certain from the listing — handling proprietary corporate data and conducting employee interviews requires strict RBAC, data privacy compliance, and audit logging, none of which are detailed in the public listing.

Not certain from the listing — operates primarily as a standalone workflow agent, but may integrate with enterprise communication platforms (e.g., Slack, Teams) to conduct interviews, introducing risks of unauthorized horizontal access or trust abuse in those ecosystems.