Otto — agentic threat model
Otto presents a moderate-to-high agentic risk profile due to its multi-agent research capabilities, web scraping, and document analysis features, which expose it to indirect prompt injection and SSRF vulnerabilities.
OWASP AIVSS score rationale
| Autonomy of Action | 0.70 | |
| Goal-Driven Planning | 0.60 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.60 | |
| Persistent Memory | 0.40 | |
| Contextual Awareness | 0.50 | |
| Dynamic Identity | 0.20 | |
| Multi-Agent Interactions | 0.80 | |
| Non-Determinism | 0.60 | |
| Opacity & Reflexivity | 0.50 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — The underlying foundation models are not specified. However, the agent is highly vulnerable to indirect prompt injection and adversarial reprogramming via malicious content encountered during web scraping or document analysis.
The agent performs heavy data operations including web scraping, document analysis, and data enrichment. This introduces significant risks of data poisoning from untrusted web sources and potential data exfiltration of sensitive uploaded documents.
Orchestrates multi-agent research and automated data filling. Threats include tool misuse (e.g., SSRF via the web scraper), insecure tool integration, and memory/state poisoning within the visual table interface.
Not certain from the listing — The hosting, sandboxing, and network isolation details are unspecified. A key threat is the lack of sandboxing during document parsing (e.g., PDF exploits) and web scraping execution.
Not certain from the listing — No evaluation, logging, or guardrail mechanisms are described. There is a risk of blind spots when agents scrape and process large volumes of external data without content filtering.
Not certain from the listing — No compliance certifications (like SOC2) or identity/access management policies are mentioned. Risks include unauthorized access to research tables and lack of audit trails for automated actions.
Explicitly utilizes multi-agent research. This introduces risks of agent-to-agent trust abuse, cascading failures where one compromised research agent misleads others, and complex, non-deterministic coordination issues.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).