Khoj — agentic threat model
Khoj presents a moderate-to-high risk profile due to its deep integration with sensitive personal data sources (Notion, local files, Whatsapp) and internet-enabled RAG, though its open-source and self-hostable nature allows users to mitigate some cloud-based exposure.
OWASP AIVSS score rationale
| Autonomy of Action | 0.50 | |
| Goal-Driven Planning | 0.40 | |
| Self-Modification | 0.20 | |
| Dynamic Tool Use | 0.60 | |
| Persistent Memory | 0.70 | |
| Contextual Awareness | 0.80 | |
| Dynamic Identity | 0.30 | |
| Multi-Agent Interactions | 0.20 | |
| Non-Determinism | 0.70 | |
| Opacity & Reflexivity | 0.50 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Integrates with multiple local and online foundation models (llama3, qwen, gemma, mistral, gpt, claude, gemini). Risks include adversarial prompt injection bypassing safety alignment, and potential data leakage to commercial model APIs if not self-hosted.
Performs RAG across diverse personal data sources (PDFs, markdown, org-mode, Notion, Word) and the internet. Highly vulnerable to indirect prompt injection via poisoned documents or malicious web search results, potentially leading to unauthorized data exfiltration.
Supports custom agent creation with personalized knowledge, personas, and tools, alongside research automation. Risks include insecure tool execution, tool misuse, and memory poisoning within the custom agent configurations.
Accessible via Browser, Desktop, Phone, Whatsapp, Obsidian, and Emacs, and is self-hostable. Security relies heavily on the host environment's isolation; vulnerabilities could lead to local file system access, credential theft (API keys), or host compromise.
Not certain from the listing — there is no explicit mention of built-in evaluation frameworks, real-time monitoring, or guardrails. Observability and logging are likely dependent on the user's self-hosted deployment configuration.
Not certain from the listing — while marketed as privacy-focused and self-hostable, specific compliance certifications (such as SOC2, GDPR, or ISO standards) are not detailed in the public directory listing.
Not certain from the listing — although users can create custom agents with personalized knowledge and tools, there is no explicit mention of a multi-agent collaboration framework or an external agent marketplace.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).