Lorikeet — agentic threat model
Lorikeet presents a high-risk profile due to its integration into financial workflows (e.g., credit card replacement) and tier 2/3 support automation. While its simulation and testing tools provide some guardrails, the potential for prompt injection to trigger unauthorized API actions in sensitive systems remains a critical concern.
OWASP AIVSS score rationale
| Autonomy of Action | 0.80 | |
| Goal-Driven Planning | 0.70 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.80 | |
| Persistent Memory | 0.50 | |
| Contextual Awareness | 0.80 | |
| Dynamic Identity | 0.30 | |
| Multi-Agent Interactions | 0.20 | |
| Non-Determinism | 0.50 | |
| Opacity & Reflexivity | 0.50 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — Lorikeet's underlying LLMs are not specified, making it vulnerable to standard foundation model threats like prompt injection (which could bypass escalation rules) or model reprogramming.
Not certain from the listing — The data pipeline, RAG sources, and vector stores used to ingest customer workflows and brand voice are unspecified, risking knowledge-base poisoning or exfiltration of sensitive customer financial data.
Lorikeet uses customizable logic and workflows to automate tier 2/3 tickets (e.g., replacing credit cards). This deep tool integration poses high risks of tool misuse or unauthorized API execution if prompt injection bypasses the logic layer.
Not certain from the listing — While deployable via chat widgets, SDKs, or existing systems, the sandboxing of these integrations and secret management for financial APIs are not detailed.
Lorikeet features 'industry leading testing and simulation tooling' to validate workflows and brand voice, mitigating some risks of drift, though real-time guardrails against adversarial inputs during live chat are unverified.
Not certain from the listing — Despite operating in the Finance sector and handling credit cards (PCI-DSS implications), specific compliance certifications (e.g., SOC2, PCI-DSS) or robust access controls are not explicitly detailed.
Not certain from the listing — The agent primarily interacts with human users and internal APIs rather than a multi-agent marketplace, minimizing cascading multi-agent trust risks, though escalation to human agents is supported.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).