Tally — agentic threat model

Not certain from the listing — Tally likely relies on advanced commercial foundation models to process complex financial statements and natural language. The primary threat is prompt injection or adversarial manipulation of financial documents, which could trick the model into misclassifying transactions or bypassing audit rules.

Not certain from the listing — The agent processes highly sensitive financial, tax, and AP data. Gaps in data isolation or lack of secure vector storage could lead to data exfiltration, unauthorized cross-tenant data access, or knowledge-base poisoning if malicious financial documents are ingested.

Not certain from the listing — Tally orchestrates multi-step workflows like AP reconciliation and document review. Insecure tool integration or flawed planning logic could allow an attacker to trigger unauthorized API calls to external accounting systems, leading to fraudulent financial entries.

Not certain from the listing — The agent integrates directly into existing corporate systems and communication channels like Microsoft Teams. Compromise of the hosting infrastructure or API keys could allow lateral movement into the host enterprise's financial network.

Not certain from the listing — While Tally 'learns from feedback,' the listing does not detail the guardrails or observability stack. A lack of robust, independent transaction logging could allow silent financial errors, drift, or malicious manipulation to go undetected.

Not certain from the listing — Operating in accounting, tax, and audit requires strict compliance (e.g., SOC 2, GLBA, GDPR). The listing does not specify the identity, authorization, or audit controls used to restrict Tally's access to sensitive ledgers.

Not certain from the listing — Tally interacts with users via Teams and its portal. Threats include unauthorized task delegation by compromised user accounts, or social engineering attacks where malicious actors trick the agent into executing unauthorized financial tasks.