Onlook — agentic threat model

Not certain from the listing — The specific foundation models used by Onlook are not disclosed. The primary L1 threat is adversarial prompt injection that could manipulate the model into generating insecure React or Tailwind code.

Not certain from the listing — It is unclear how Onlook indexes the local codebase or if it utilizes a local vector database. However, because data remains local, the risk of external data exfiltration or cloud-based training data poisoning is minimized.

The agent framework translates visual edits and AI prompts into local React code modifications. The main threat is tool misuse or insecure file-writing operations where the agent could overwrite critical configuration files or inject malicious scripts into the codebase.

Onlook runs locally in the developer's environment. While this protects data privacy, a compromise of the tool could lead to local privilege escalation or unauthorized file system access on the developer's workstation if the application lacks proper sandboxing.

Not certain from the listing — There is no mention of built-in guardrails, real-time code scanning, or observability tools to detect if the AI is generating insecure patterns or if the visual editor is being abused.

Onlook relies on the developer's local environment and version control (e.g., Git) for security and tracking. It does not advertise enterprise compliance certifications (like SOC2) but leverages local-first architecture as its primary security control.

Onlook operates as a standalone local developer tool. There are no multi-agent orchestrations or marketplace integrations described, making ecosystem-level cascading failures highly unlikely.