AI agent for home assistant — agentic threat model

Uses OpenAI or Llama APIs. Highly vulnerable to prompt injection (indirect or direct) where malicious inputs or manipulated entity states could reprogram the LLM to generate unauthorized automations or execute unintended home operations.

Connects to all Home Assistant entities to read state data. This presents a data exfiltration risk, as sensitive home telemetry (occupancy, security system status, camera metadata) is sent to external third-party LLM providers.

Translates natural language queries directly into Home Assistant service calls and automations. Insecure tool integration is a major threat, as the agent lacks a robust verification layer to prevent dangerous tool execution (e.g., unlocking doors via natural language).

Not certain from the listing — likely runs as a Home Assistant custom component (Python) within the local HA container or host. Threats include a lack of sandboxing, potentially allowing a compromised agent to execute arbitrary Python code on the host or access local network secrets.

Not certain from the listing — likely relies on standard Home Assistant system logs. Threats include a lack of specialized LLM guardrails, evaluation metrics, or anomaly detection to flag malicious or erratic automation patterns before execution.

Not certain from the listing — likely inherits Home Assistant's base authentication but lacks fine-grained access control (RBAC) for the AI agent itself, meaning any user with access to the agent can control all connected physical entities.

Not certain from the listing — does not explicitly mention multi-agent interactions, but could interact with other Home Assistant integrations or external smart home ecosystems, risking cascading failures if a connected service is compromised.