Semantic Kernel — agentic threat model

Acts as an integration layer for external foundation models (OpenAI, Azure OpenAI, Hugging Face). It is inherently vulnerable to upstream model threats like prompt injection, adversarial reprogramming, and model-level data leakage.

Provides memory abstractions and connectors for data sources and vector stores. Risks include data exfiltration via prompt injection and potential knowledge-base poisoning if untrusted data is ingested into the memory connectors.

This is the core risk area. The framework's Planner and Plugin systems allow LLMs to dynamically select and execute functions. Insecure tool integration or planner manipulation could lead to unauthorized function execution or remote code execution.

Not certain from the listing — As an SDK embedded in C#, Java, or Python applications, deployment security, sandboxing of plugins, and secrets management depend entirely on the host application's infrastructure.

Not certain from the listing — While the SDK provides abstractions for logging and telemetry, the listing does not specify built-in guardrails, drift detection, or automated evaluation mechanisms.

Not certain from the listing — Compliance, identity management, and authorization controls are delegated to the developer implementing the SDK and the underlying cloud providers (e.g., Azure).

Not certain from the listing — The listing focuses on single-agent planners and plugins; multi-agent orchestration and ecosystem-level trust boundaries are not explicitly detailed.