Pactory.ai — agentic threat model

Not certain from the listing — Pactory acts as an intermediary marketplace for vertical LLMs rather than hosting a specific proprietary foundation model, leaving model-level vulnerabilities like adversarial alignment dependent on the hired third-party models.

Not certain from the listing — The data operations, vector stores, and RAG pipelines of the hired vertical LLMs are managed externally, introducing risks of data exfiltration or poisoning during transit between agents.

Pactory provides orchestration framework capabilities allowing agents to dynamically discover, hire, and integrate specialized LLMs at runtime, which introduces risks of insecure tool integration and dynamic execution of untrusted model outputs.

Not certain from the listing — The hosting environment, sandboxing of hired LLMs, and API key management are not detailed, presenting potential risks of lateral movement if a hired vertical LLM is compromised.

Not certain from the listing — There is no mention of built-in evaluation, logging, or guardrails to monitor the interactions, outputs, or financial transactions of hired vertical LLMs.

Not certain from the listing — While it handles monetization and API access, specific identity, authorization, and compliance controls like the EU AI Act or NIST frameworks are not described.

Pactory is fundamentally an agent ecosystem and marketplace enabling agent-to-agent hiring and monetization, which highly exposes it to rogue/compromised agents, cascading failures, and financial/trust abuse across dynamic agent-to-agent transactions.