Milo - AI Data Analyst — agentic threat model

Not certain from the listing — The specific foundation models used by Milo are undisclosed. The primary threat at this layer is adversarial manipulation of input data streams to trick the model into generating false root-cause explanations or misaligned outputs.

Milo continuously processes real-time organizational data streams. This creates a high risk of data poisoning, where malicious data injected into the stream could manipulate Milo's anomaly detection or trigger unauthorized automated actions.

Milo's orchestration framework must safely translate data insights into automated actions. Insecure tool integration or prompt injection could allow an attacker to hijack the action-triggering mechanism to execute unauthorized API calls.

Not certain from the listing — The hosting environment, sandboxing of action execution, and secrets management for data stream access are unspecified. Compromise here could lead to full data exfiltration or lateral movement into connected corporate networks.

Milo acts as an observability tool, but its own internal monitoring is undefined. There is a risk of blind spots where malicious actions triggered by the agent go unnoticed due to insufficient logging of its autonomous decisions.

Not certain from the listing — There is no mention of enterprise security controls, role-based access control (RBAC), or compliance certifications (e.g., SOC2) governing which users can configure or authorize Milo's automated actions.

Not certain from the listing — While Milo operates horizontally, there is no explicit mention of multi-agent orchestration. However, cascading failures could occur if Milo's automated actions trigger unintended downstream behaviors in other automated systems.