MyPolicyReview.ai — agentic threat model

Not certain from the listing — likely relies on third-party or open-source LLMs to parse and interpret complex policy language. The primary threat is prompt injection embedded within uploaded PDFs (indirect prompt injection) which could manipulate the model's assessment of exclusions or limits, or cause it to hallucinate coverage gaps.

Not certain from the listing — requires a data ingestion pipeline to process uploaded PDFs and potentially store them for renewal tracking. Threats include unauthorized access to stored policy documents containing sensitive PII and asset details, as well as potential data leakage if the uploaded data is used to train or fine-tune underlying models.

Not certain from the listing — likely uses a basic document-processing orchestration framework rather than an advanced agentic loop. The main threat is insecure integration with PDF parsing tools, which could be exploited via malicious PDF files to execute arbitrary code or bypass extraction logic.

Not certain from the listing — hosted as a freemium web application. Vulnerabilities could exist in the web server hosting the platform, the PDF parsing sandbox (or lack thereof), and the storage buckets where uploaded policies are kept.

Not certain from the listing — there is no mention of automated guardrails or evaluation frameworks to verify the accuracy of the AI's policy analysis, creating a risk of undetected hallucinations regarding critical policy exclusions.

Not certain from the listing — despite handling highly sensitive financial, residential, and personal data contained in insurance policies, no compliance standards (such as SOC2, ISO 27001, or GDPR-compliant data deletion policies) are specified.

Not certain from the listing — currently operates as a standalone horizontal tool with no described multi-agent interactions or external ecosystem integrations.