Domer AI — agentic threat model
Domer AI is a low-autonomy video generation platform leveraging external foundation models, presenting primary risks around content safety (deepfakes, copyright) rather than agentic execution or systemic compromise.
OWASP AIVSS score rationale
| Autonomy of Action | 0.10 | |
| Goal-Driven Planning | 0.10 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.20 | |
| Persistent Memory | 0.10 | |
| Contextual Awareness | 0.20 | |
| Dynamic Identity | 0.00 | |
| Multi-Agent Interactions | 0.00 | |
| Non-Determinism | 0.80 | |
| Opacity & Reflexivity | 0.70 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Utilizes multiple external foundation models (Veo, Kling, Seedance). Primary threats include adversarial prompt injection to bypass safety filters, generating misaligned/harmful video outputs, and intellectual property/copyright concerns regarding training data.
Not certain from the listing — The platform processes user-uploaded photos and text prompts. Risks include potential data leakage of private user images if stored insecurely, and lack of clarity on whether user inputs are used to train or fine-tune downstream models.
Not certain from the listing — Orchestration appears limited to routing user prompts to video generation APIs. There is no evidence of complex agentic planning, tool use, or stateful memory frameworks that could be exploited.
Not certain from the listing — Hosted as a closed-source SaaS platform. Standard web infrastructure risks apply, including potential denial of service (DoS) via resource-intensive video generation requests and SSRF if the platform fetches images from user-provided URLs.
Not certain from the listing — No details are provided regarding input/output guardrails, automated content moderation, or observability tools to detect and block the generation of deepfakes, misinformation, or NSFW content.
Not certain from the listing — There is no mention of compliance certifications (e.g., SOC2, GDPR) or identity governance. The lack of watermarks on generated videos increases compliance and misuse risks under emerging AI regulations like the EU AI Act.
Not certain from the listing — Domer AI operates as a standalone horizontal tool with no described multi-agent interactions, marketplace integrations, or agent-to-agent trust boundaries.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).