Edexia — agentic threat model

Not certain from the listing — the underlying foundation models are not specified, but they are highly susceptible to prompt injection attacks where students attempt to manipulate grading outputs or extract system rubrics.

Not certain from the listing — the platform processes sensitive student submissions and teacher rubrics. Risks include data leakage of student PII and potential poisoning of the adaptive learning profile that tracks the teacher's grading style.

Not certain from the listing — the orchestration framework for parsing rubrics and generating real-time feedback is proprietary. Vulnerabilities here could allow malicious inputs to bypass grading constraints or execute unauthorized tool calls.

Not certain from the listing — hosting and sandboxing environments are not detailed. However, integration with existing educational tools (like LMS platforms via LTI) introduces risks related to API key exposure and session hijacking.

Not certain from the listing — while the system 'learns from corrections', there is no explicit mention of automated guardrails or drift detection to prevent the grading criteria from silently degrading or exhibiting bias over time.

Not certain from the listing — compliance with student data privacy regulations (such as FERPA or GDPR) is critical for EdTech but not detailed, though the emphasis on 'teacher control' provides a manual policy enforcement point.

The agent operates as a standalone educational assistant integrated into existing LMS platforms; there are no described multi-agent interactions or marketplace ecosystems, minimizing cascading agent-to-agent risks.