Relay.app — agentic threat model
Relay.app presents a moderate-to-high risk profile due to its extensive integration with sensitive business tools (Gmail, Slack, Notion), balanced significantly by its core design emphasis on human-in-the-loop (HITL) approvals.
OWASP AIVSS score rationale
| Autonomy of Action | 0.40 | |
| Goal-Driven Planning | 0.50 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.80 | |
| Persistent Memory | 0.30 | |
| Contextual Awareness | 0.60 | |
| Dynamic Identity | 0.50 | |
| Multi-Agent Interactions | 0.30 | |
| Non-Determinism | 0.50 | |
| Opacity & Reflexivity | 0.40 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — The specific foundation models powering the summarization, translation, and custom prompts are not disclosed. Standard LLM threats such as prompt injection and output manipulation could affect downstream automated actions.
Not certain from the listing — While the platform extracts and processes data from integrations like Notion and Gmail, the underlying data storage, caching, or RAG mechanisms are not specified. Key threats include data leakage and lack of data lineage.
The platform orchestrates workflows and mini AI agents using custom prompts and over 100 integrations. The primary threat is tool misuse, where an LLM-driven step executes unintended actions (e.g., sending unauthorized emails or Slack messages) due to prompt injection.
Not certain from the listing — As a closed-source SaaS platform, details regarding secrets management (for the 100+ OAuth integrations) and execution sandboxing are omitted. Compromise of the infrastructure could expose sensitive third-party API tokens.
Not certain from the listing — The listing does not detail automated guardrails, evaluation frameworks, or logging mechanisms, though the platform's manual approval steps serve as a functional human-driven observability layer.
Relay.app explicitly implements human-in-the-loop (HITL) controls, allowing users to mandate approvals, tasks, and manual data entry. This acts as a strong policy control to prevent runaway automated actions, though enterprise RBAC details are not specified.
The platform functions as an ecosystem hub connecting multiple third-party apps and mini-agents. This introduces risks of cascading failures and trust abuse, where a compromise in one connected app (e.g., Slack) could trigger malicious workflows in another (e.g., Gmail).
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).
These scores are auto-generated from public information (the agent's own listing, docs, and repository) using the canonical OWASP AIVSS formula and the MAESTRO framework — an estimate for guidance, not a penetration test, audit, or certification. See the scoring methodology. Are you the vendor? Factual corrections are free.