Helicone AI — agentic threat model

Not certain from the listing — Helicone is an observability platform rather than a foundation model, but it interacts directly with them. The primary threat at this layer is the exposure or leakage of system prompts managed within Helicone's prompt management feature.

Helicone logs, traces, and caches LLM inputs and outputs. Threats include data exfiltration of sensitive user queries stored in the database, cache poisoning of the caching mechanism, and unauthorized access to historical interaction logs.

Helicone provides agent tracing and prompt management. Threats include insecure integration where tracing SDKs might inadvertently capture and leak framework-level secrets, memory states, or local variables during execution.

Not certain from the listing — As an open-source platform, deployment security depends heavily on the hosting environment. Threats include container compromise, unauthorized access to the database hosting the logs, and exposure of API keys used to route traffic.

This is Helicone's core capability. It provides cost tracking, latency monitoring, and rate limiting. Threats include log injection attacks to distort analytics, evasion of rate limits, and blind spots if attackers bypass the proxy to communicate directly with the LLM.

Not certain from the listing — The directory listing does not specify built-in access controls, RBAC, or compliance certifications. The main risk is the lack of strict access controls over sensitive telemetry data and API keys.

Not certain from the listing — Helicone traces agent workflows but does not orchestrate multi-agent ecosystems. Risks are limited to cascading visibility failures or denial of service in downstream agent applications if the observability proxy fails.