ButtonAI — agentic threat model

Not certain from the listing — The underlying LLM used for generating ad copy and analyzing websites is unspecified. It is highly vulnerable to indirect prompt injection if the scraped target website contains adversarial text designed to manipulate the generated ad groups or landing page content.

Not certain from the listing — The agent ingests and structures knowledge from external business websites. If these websites are compromised or contain untrusted user-generated content, it could poison the agent's internal knowledge base, leading to corrupted campaign generation.

Not certain from the listing — The orchestration framework managing the transition from website analysis to landing page hosting and Google Ads API execution is proprietary. Vulnerabilities here could allow tool misuse, such as executing unauthorized API calls to Google Ads.

Not certain from the listing — The agent hosts landing pages for each ad group. If the hosting infrastructure is insecure, attackers could exploit it to host phishing pages, malware, or perform defacement under the hosted domain.

Not certain from the listing — The mechanism for 'continuously improving' campaigns implies an automated feedback loop. Without strict guardrails, this loop could be gamed by external click fraud or adversarial ad interactions, leading to budget depletion.

Not certain from the listing — The agent requires OAuth permissions to manage Google Ads accounts. Insecure storage of these high-privilege credentials or lack of tenant isolation poses a severe risk of widespread account takeovers.

Not certain from the listing — While primarily a single-agent SaaS, it operates within the broader Google Ads ecosystem. Malicious changes or policy updates in the Google Ads API could cause cascading failures in the agent's deployment pipeline.