Chatmoat — agentic threat model
Chatmoat is a low-autonomy, RAG-based customer support chatbot with low agentic risk, primarily vulnerable to prompt injection, website data poisoning, and potential client-side XSS via its JavaScript integration.
OWASP AIVSS score rationale
| Autonomy of Action | 0.30 | |
| Goal-Driven Planning | 0.10 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.10 | |
| Persistent Memory | 0.20 | |
| Contextual Awareness | 0.40 | |
| Dynamic Identity | 0.00 | |
| Multi-Agent Interactions | 0.00 | |
| Non-Determinism | 0.60 | |
| Opacity & Reflexivity | 0.50 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — The underlying foundation models are not specified, but they are susceptible to standard LLM risks such as prompt injection, model reprogramming, and generating misaligned or toxic outputs to customers.
The agent trains directly on website content. This introduces a high risk of data poisoning if an attacker can manipulate the source website's public content, leading the chatbot to serve malicious instructions or misinformation.
The orchestration framework appears to be a simple Q&A RAG system. The primary threat is prompt injection bypassing system instructions to leak the system prompt or retrieve unauthorized context.
Delivered via a JavaScript snippet on client websites. This introduces client-side security risks, where a compromise of Chatmoat's hosting or a stored XSS via the chatbot's output could lead to DOM-based XSS on the host website.
Not certain from the listing — There is no mention of built-in guardrails, output filtering, or observability dashboards to monitor for drift, hallucinations, or adversarial inputs.
Not certain from the listing — No compliance certifications (e.g., SOC2, GDPR) or access control mechanisms are detailed for the builder dashboard or data storage.
The agent operates as a standalone customer support widget with no multi-agent orchestration or marketplace integrations described, minimizing ecosystem-level cascading risks.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).