EmbedBot — agentic threat model

Not certain from the listing — The specific foundation models used are undisclosed. The primary threat is prompt injection via public customer chat or email inputs, which could lead to model reprogramming, system prompt leakage, or generation of misaligned/toxic outputs.

Not certain from the listing — The underlying database or vector store for lead capture and ticket resolution is not specified. Threats include the exfiltration of customer PII (emails, chat logs) and potential knowledge-base poisoning if the agent learns from untrusted customer inputs.

Not certain from the listing — The orchestration framework is proprietary. The main threat is tool misuse, where an attacker uses crafted inputs to force the agent to perform unauthorized ticket modifications, send spam emails, or trigger unintended Slack escalations.

Not certain from the listing — Hosting and sandboxing details are omitted. A key threat is the exposure of sensitive API keys (Slack tokens, email server credentials) which, if compromised, could allow attackers to move laterally into internal corporate communication channels.

Not certain from the listing — There is no mention of real-time guardrails, output filtering, or anomaly detection. This creates a blind spot where malicious or hallucinated responses could be sent directly to customers without administrative oversight.

Not certain from the listing — No compliance certifications (such as SOC2, GDPR, or HIPAA) are cited. The lack of defined access controls and audit logging for automated ticket resolutions poses compliance and data privacy risks regarding customer interactions.

Not certain from the listing — While not explicitly a multi-agent system, the agent interacts deeply with third-party ecosystems (Slack, Email). Threats include API rate-limiting, cascading failures if Slack/Email APIs go down, and trust abuse where the agent is used as a vector to phish internal employees on Slack.