DSPy — agentic threat model

DSPy interacts directly with foundation models to optimize prompts. It is highly susceptible to adversarial prompt injection that can bypass compiled instructions, as well as model output drift that invalidates optimized signatures.

DSPy relies on training, validation, and bootstrap datasets to optimize prompts. This introduces a significant threat of data poisoning, where malicious training examples manipulate the compiler into generating insecure or backdoored system prompts.

As an orchestration framework, DSPy's teleprompters and assertion modules govern program flow. Vulnerabilities in the compilation logic or assertion-guided backtracking could lead to infinite loops, denial of service, or logic bypasses.

Not certain from the listing — DSPy is distributed as an open-source Python library. Infrastructure security, API key management, and runtime sandboxing are entirely dependent on the developer's deployment environment.

DSPy integrates performance metrics to drive optimization. This creates a risk of 'evaluation gaming', where the optimizer satisfies the programmatic metric (e.g., matching a regex or length) while producing unsafe or hallucinated outputs.

Not certain from the listing — The framework does not specify built-in access controls, audit logging, or compliance frameworks, leaving these cross-cutting concerns to the hosting application.

Not certain from the listing — While DSPy can compile multi-module pipelines, it does not natively manage a multi-agent ecosystem, agent-to-agent trust boundaries, or third-party agent marketplaces.