ChatGPT Atlas — agentic threat model

Not certain from the listing — likely powered by OpenAI's proprietary GPT-4 series models. The primary model-level threat is indirect prompt injection, where malicious instructions embedded in visited web pages hijack the model's behavior.

Processes active page content and utilizes 'browser memory'. Threats include memory poisoning (where malicious web content permanently corrupts the agent's long-term context) and the exfiltration of sensitive user data extracted from web pages.

Features an 'agent mode' capable of executing multi-step tasks like shopping and researching. Threats include tool misuse and insecure tool integration, where the agent is manipulated into performing unintended transactions or form submissions on active websites.

Deployed as a native macOS application. Key threats include sandbox escapes from the browser environment to the host macOS system, and insecure local storage of session tokens, history, or browser memory.

Not certain from the listing — no details are provided regarding real-time monitoring, guardrails, or logging of agent actions. A lack of observability could allow malicious actions taken by the agent mode to go undetected by the user.

Includes privacy controls such as incognito mode, site permissions, and history clearing. Threats include the bypass of site-specific permissions, accidental leakage of incognito session data into the persistent AI memory, and compliance violations regarding automated processing of personal data.

Not certain from the listing — no explicit multi-agent or marketplace features are described. The primary ecosystem threat would be future integrations with third-party web services or extensions that introduce cascading trust vulnerabilities.