cognee — agentic threat model

Integrates with external LLM providers (Anyscale, OpenAI) or local models (Ollama). Risks include prompt injection altering the extraction logic during the 'Cognify' phase, and potential data leakage to third-party LLM APIs.

Highly critical layer for Cognee. Supports LanceDB, Qdrant, PGVector, Weaviate, NetworkX, and Neo4j. Threats include vector/graph database poisoning, unauthorized graph traversal leading to data exfiltration, and lack of document-level access controls during retrieval.

Implements ECL (Extract, Cognify, Load) pipelines. Vulnerabilities could arise from insecure pipeline execution, memory poisoning of past conversations, and lack of sanitization on extracted metadata before loading into graph/vector stores.

Runs locally by default (LanceDB, NetworkX, Ollama), which limits external network exposure but places the security burden entirely on the host environment. If deployed in a shared cloud environment, insecure database connections or exposed API endpoints pose significant risks.

Not certain from the listing — The directory listing does not mention built-in evaluation, monitoring, or guardrail mechanisms to detect drift, anomalous queries, or poisoned data ingestion within the ECL pipelines.

Not certain from the listing — There is no mention of authentication, authorization, role-based access control (RBAC) for data retrieval, or compliance certifications (e.g., SOC2, GDPR) for handling sensitive personal documents.

Not certain from the listing — The framework is presented as a standalone memory/knowledge layer and does not explicitly detail multi-agent communication protocols or marketplace integrations.