Agent Frank — agentic threat model
Agent Frank presents a moderate-to-high risk profile due to its ability to autonomously send emails and book meetings (Auto-Pilot mode) using dedicated email infrastructure. While the Co-Pilot mode offers a strong human-in-the-loop mitigation, fully autonomous operation exposes the organization to brand reputation damage, domain blacklisting, and potential data exfiltration if compromised.
OWASP AIVSS score rationale
| Autonomy of Action | 0.80 | |
| Goal-Driven Planning | 0.70 | |
| Self-Modification | 0.20 | |
| Dynamic Tool Use | 0.70 | |
| Persistent Memory | 0.60 | |
| Contextual Awareness | 0.60 | |
| Dynamic Identity | 0.50 | |
| Multi-Agent Interactions | 0.50 | |
| Non-Determinism | 0.60 | |
| Opacity & Reflexivity | 0.40 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — likely relies on commercial LLMs (e.g., GPT-4) for multilingual generation. Threats include prompt injection leading to brand damage, offensive output generation, or misaligned sales pitches.
Not certain from the listing — likely uses RAG or database lookups for product details, prospect data, and custom sales collateral. Threats include data poisoning of the product knowledge base or unauthorized exfiltration of prospect contact lists.
Orchestrates email sequences, prospecting, and meeting booking. Supports Auto-Pilot (autonomous tool execution) and Co-Pilot (HITL). Threats include tool misuse (e.g., spamming, unauthorized meeting bookings) and prompt injection hijacking the email generation tool.
Uses dedicated email infrastructure with warm-up capabilities and integrates with Salesforge. Threats include domain reputation damage, email infrastructure hijacking for phishing campaigns, and insecure API integrations with calendar/CRM systems.
Features a Co-Pilot mode allowing manual review, edit, and approval of messages, which serves as a strong human-in-the-loop guardrail. However, Auto-Pilot mode lacks this, increasing reliance on automated logging and drift detection which are not detailed.
Not certain from the listing — no explicit mention of SOC2, GDPR compliance (critical for outbound emailing/prospecting), or fine-grained RBAC for managing multiple agents.
Supports running multiple agents alongside existing sales teams within Salesforge. Threats include multi-agent coordination failures, cascading email storms, or cross-agent data leakage.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).