addto.me — agentic threat model

Not certain from the listing — utilizes an unspecified 'reasoning AI model' to process natural language and voice. Threats include adversarial prompt injection via chat or voice transcripts, potentially hijacking the reasoning flow to trigger unauthorized tool actions.

Not certain from the listing — must handle and store OAuth tokens and user configuration data to access Notion, Jira, and Google Calendar. Threats include credential theft, data exfiltration from connected knowledge bases, and lack of clear data retention policies.

The agent orchestrates multi-step workflows across diverse APIs (Jira, Notion, Calendly) based on user intent. Threats include insecure tool integration, tool misuse (e.g., deleting or modifying critical project tickets/pages via indirect injection), and lack of strict schema validation on tool inputs.

Not certain from the listing — hosted as a closed-source SaaS platform. Threats include host/container compromise, exposure of webhook endpoints handling WhatsApp/Telegram traffic, and insecure storage of API secrets.

Not certain from the listing — no mention of guardrails, input filtering, or transaction logging. Threats include blind spots in detecting malicious commands embedded in voice messages or native chat replies.

Not certain from the listing — handles highly sensitive corporate and personal data across multiple platforms without explicit mention of compliance standards (e.g., SOC2, GDPR) or fine-grained authorization policies to restrict agent actions.

Not certain from the listing — primarily functions as a single-agent orchestrator connecting to third-party APIs. Threats are focused on API-to-API trust abuse rather than complex multi-agent cascading failures.