gptme — agentic threat model

Not certain from the listing — supports several LLM providers (both local and cloud), making its vulnerability to prompt injection, adversarial reprogramming, or model-specific exploits highly dependent on the user's chosen backend model.

Not certain from the listing — primarily operates on local files and web search rather than a dedicated vector database, but its file read/write capabilities expose local data to exfiltration if the agent is compromised.

High risk of tool misuse and insecure tool integration; the framework allows arbitrary terminal execution, file modification, and web browsing, which can be chained maliciously via prompt injection from untrusted web content or files.

Runs locally in the user's terminal without default sandboxing ('unconstrained local alternative'), meaning any compromised execution has direct access to the host system, local network, and user privileges.

Not certain from the listing — provides a CLI and optional Web UI for interaction, but lacks built-in security guardrails, automated policy enforcement, or anomaly detection to monitor malicious tool usage.

Lacks built-in authentication or authorization controls, relying entirely on the host operating system's user permissions, presenting significant compliance and access control risks if run in enterprise environments.

Not certain from the listing — designed as a standalone personal assistant rather than a multi-agent orchestrator, minimizing direct agent-to-agent ecosystem risks unless manually integrated into larger workflows.