Floode — agentic threat model

Not certain from the listing — The specific foundation models used are not disclosed. However, the model is highly vulnerable to indirect prompt injection via incoming emails, which could reprogram the model to exfiltrate data or draft malicious replies.

Floode ingests and processes highly sensitive user data including emails, calendar events, and tasks. This creates a significant risk of data exfiltration or knowledge-base poisoning if malicious content is parsed and stored in the agent's context.

The agent orchestrates tools for email drafting, scheduling, and task prioritization. Vulnerabilities in the orchestration framework could lead to tool misuse, such as sending unauthorized emails or modifying calendar events without user consent.

Not certain from the listing — The hosting environment, sandboxing mechanisms, and secrets management for OAuth tokens are unspecified. A compromise at this layer would expose user credentials and access tokens to email and calendar providers.

Not certain from the listing — There is no mention of evaluation frameworks, guardrails, or real-time monitoring to detect anomalous behavior, prompt injection attempts, or drift in email drafting quality.

Not certain from the listing — Compliance certifications (e.g., SOC 2, GDPR) and fine-grained authorization policies are not detailed. Strong identity and access management are critical given the agent's read/write access to personal and corporate communications.

Not certain from the listing — No multi-agent interactions or external agent ecosystem integrations are described, limiting the immediate risk of cascading agent-to-agent failures.