NotebookLM — agentic threat model
NotebookLM presents a low-to-moderate agentic risk profile due to its limited autonomy and lack of active tool execution. The primary security vectors are indirect prompt injection and data exfiltration via malicious user-uploaded documents or ingested web URLs.
OWASP AIVSS score rationale
| Autonomy of Action | 0.20 | |
| Goal-Driven Planning | 0.10 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.30 | |
| Persistent Memory | 0.40 | |
| Contextual Awareness | 0.70 | |
| Dynamic Identity | 0.00 | |
| Multi-Agent Interactions | 0.10 | |
| Non-Determinism | 0.60 | |
| Opacity & Reflexivity | 0.50 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Powered by Gemini 1.5 Pro. Primary threats include adversarial prompt injection (especially indirect prompt injection via untrusted source documents or web URLs) and model hallucinations during summarization or audio generation.
RAG-based architecture ingesting PDFs, Google Docs, Slides, web URLs, and audio. Key threats include knowledge-base poisoning from malicious sources, data exfiltration via markdown injection, and unauthorized access to integrated Google Drive files.
Orchestrates document parsing, chunking, vector search, and audio generation. Threats include insecure parsing of complex file formats (PDFs, audio, slides) and prompt injection bypassing system instructions during summarization.
Not certain from the listing — Google-hosted closed-source infrastructure likely runs on Google Cloud Platform with robust sandboxing for file processing, but specific containerization, network isolation, and secrets management details are not disclosed.
Not certain from the listing — Provides inline citations with direct links to source material to verify outputs, but internal guardrails, logging mechanisms, and abuse detection systems are not detailed.
Not certain from the listing — Integrates with Google accounts for access control, but specific compliance certifications (like SOC2, ISO 27001) or enterprise data privacy policies for NotebookLM are not explicitly detailed in the directory listing.
Primarily a single-user research assistant with minimal multi-agent risk. However, indirect ecosystem risks exist when ingesting third-party web URLs or shared notebooks which could contain malicious payloads targeting the user's session.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).