Makeform AI — agentic threat model

Not certain from the listing — Likely relies on commercial LLMs to translate user prompts into form schemas. Risks include prompt injection that could force the model to generate phishing forms or embed malicious scripts into the form structure.

Not certain from the listing — Handles user-defined form schemas and potentially collected form submission data. Risks include data exfiltration of sensitive form submissions and potential training data poisoning if user inputs are used to train future form-generation models.

Not certain from the listing — Orchestrates the generation of form fields and workflow logic. Risks include insecure tool integration if the framework automatically connects generated forms to external databases or APIs without strict validation.

Not certain from the listing — Hosted as a closed-source SaaS platform. Risks include infrastructure compromise leading to unauthorized access to hosted forms and the databases storing user form submissions.

Not certain from the listing — No details on guardrails to prevent the generation of deceptive (phishing) forms. Risks include a lack of real-time monitoring to detect when the AI is being abused to generate malicious data-gathering interfaces.

Not certain from the listing — No explicit mention of compliance standards (e.g., GDPR, HIPAA) which are critical for forms collecting personally identifiable information (PII). Risks include regulatory non-compliance and weak access controls over form data.

Not certain from the listing — The mention of 'workflows' implies integration with external ecosystems (e.g., webhooks, email services). Risks include cascading failures or unauthorized data transmission if downstream workflow integrations are hijacked.