Durable AI — agentic threat model

Not certain from the listing — The underlying LLMs used for generating marketing copy and website layouts are unspecified. Primary threats include prompt injection leading to the generation of malicious scripts (XSS) or deceptive phishing content within the generated website.

Not certain from the listing — The platform stores user business details, CRM contacts, and invoicing data. Threats include unauthorized access to tenant databases, data leakage between client accounts, and lack of clear data retention policies for sensitive customer PII.

Not certain from the listing — The orchestration framework translating user prompts into structured websites, CRM schemas, and invoices is proprietary. Vulnerabilities could allow attackers to manipulate tool-calling mechanisms to generate unauthorized invoices or modify DNS settings.

Not certain from the listing — While the listing mentions domain hosting with SSL security, the underlying hosting infrastructure and sandboxing of generated code are undisclosed. Threats include server-side SSRF, sub-domain hijacking, and hosting-level resource exhaustion.

Not certain from the listing — There is no mention of automated guardrails or content moderation to prevent the platform from being used to generate malicious, fraudulent, or policy-violating websites at scale.

Not certain from the listing — Although SSL is provided, compliance with critical standards such as GDPR (for CRM data) and PCI-DSS (for invoicing/payments) is not explicitly detailed in the public directory listing.

Not certain from the listing — The platform operates as a standalone horizontal solution. There is no evidence of multi-agent collaboration or third-party agent marketplace integrations that would introduce cascading ecosystem risks.