Hunch — agentic threat model

Hunch explicitly integrates 'any combination of AI models (text, image, audio and more)'. This multi-model approach increases exposure to model-specific vulnerabilities, adversarial prompt injections, and inconsistent safety alignments across different third-party providers.

Not certain from the listing — The directory does not specify how user data, prompts, or generated assets are stored, cached, or whether RAG/vector databases are utilized. Potential threats include data leakage of sensitive corporate prompts and lack of data lineage.

Acts as a visual orchestration framework allowing users to 'break tasks down into smaller steps' and 'create prompts and flow'. Vulnerabilities include insecure workflow logic execution, prompt injection that bypasses intended step boundaries, and insecure handling of API keys for the various models.

Not certain from the listing — No details are provided regarding hosting infrastructure, sandboxing of workflow execution, or secrets management for user-provided model APIs. This presents risks of credential theft and infrastructure compromise if API keys are stored insecurely.

Not certain from the listing — There is no mention of built-in guardrails, execution logging, or observability tools to monitor the outputs of the chained models, creating potential blind spots for toxic or hallucinated outputs.

Not certain from the listing — The platform is closed-source and free, with no explicit mention of enterprise security controls, access policies, RBAC, or compliance certifications (like SOC2), raising compliance risks for corporate deployment.

Hunch allows users to 'reuse, automate, and share your work, giving your team new skills'. This introduces ecosystem risks where compromised, malicious, or poorly constructed workflows ('skills') can be distributed horizontally across an organization, leading to cascading failures.