Yutori — agentic threat model

Utilizes proprietary post-training models. Vulnerable to adversarial prompt injection that could bypass safety guardrails to execute unauthorized web actions or bookings.

Not certain from the listing — likely stores user credentials, session cookies, and personal preferences to facilitate automated booking and scheduling, raising significant risks of data exfiltration or credential theft if the storage layer is compromised.

Employs an 'agent-first architecture' with 'durable workflow execution' for persistent tasks. Vulnerable to workflow hijacking and insecure tool integration, where malicious web page content could manipulate the web automation tool during scraping or booking.

Not certain from the listing — always-on agents executing web automation require secure, isolated sandboxing to prevent container escape, local privilege escalation, or IP reputation abuse during automated web tasks.

Not certain from the listing — while 'durable workflow execution' implies state monitoring, specific evaluation frameworks, drift detection, or real-time guardrails to prevent automated loop failures are not detailed.

Not certain from the listing — handling user-delegated tasks like booking and scheduling requires robust identity management, secure credential vaulting, and compliance with privacy regulations, which are not specified.

Not certain from the listing — although the platform features multiple 'Scouts', it is unclear if they interact in a multi-agent ecosystem or marketplace, which would introduce risks of cascading failures or agent-to-agent trust abuse.