Sendmux — agentic threat model

Not certain from the listing — Sendmux is an infrastructure and API layer for email routing rather than a foundation model provider. It does not explicitly host or run LLMs, though it cleans message content for consumption by downstream models.

Handles cleaned message content, threads, attachments, and mailbox history used for agent memory. Threats include data exfiltration of sensitive emails, attachment-based malware/poisoning, and lack of data lineage for incoming email content.

Provides mailbox-scoped API keys, webhooks, and SSE events to integrate with agent frameworks. Threats include insecure tool integration where agents execute untrusted commands parsed from incoming emails, and tool misuse leading to unauthorized outbound emails.

Manages multi-provider email sending, Gmail/Outlook OAuth tokens, SMTP credentials, and Amazon SES. Threats include compromise of stored OAuth tokens, credential theft, lateral movement via SMTP/SES, and lack of sandboxing for incoming attachments.

Features per-provider quotas, throttling, health checks, and signed webhooks. Threats include insufficient logging of malicious email payloads, blind spots in webhook delivery, and bypass of throttling mechanisms by malicious actors.

Implements mailbox-scoped API keys, signed webhooks, and OAuth integrations. Threats include weak authorization controls, token leakage, and compliance violations (e.g., GDPR/HIPAA) regarding the storage and processing of raw email data.

Enables multi-agent interactions via dedicated agent mailboxes. Threats include agent-to-agent trust abuse (e.g., one compromised agent emailing another to trigger malicious workflows) and cascading failures across horizontal agent ecosystems.