Enso — agentic threat model

Not certain from the listing — Enso likely wraps commercial LLMs (like OpenAI or Anthropic) to power its virtual employees. Threats include prompt injection leading to unauthorized tool execution or model misalignment during automated customer interactions.

Not certain from the listing — Enso agents process SMB business data, leads, and marketing content. Threats include data exfiltration of sensitive CRM/customer data and knowledge-base poisoning if agents ingest untrusted external inputs during lead generation.

Not certain from the listing — The platform uses task-focused orchestration for background execution. Threats include insecure tool integration (e.g., CRM write access) and tool misuse if an agent is manipulated via malicious incoming emails or web content.

Not certain from the listing — Enso hosts these agents as a SaaS marketplace. Threats include container escape, privilege escalation, or credential theft of API keys used to connect to SMB tools (e.g., email providers, social media accounts).

Not certain from the listing — The listing mentions 'guided setup' but no explicit logging, guardrails, or drift monitoring. Gaps here could lead to undetected agent drift or silent failures in background tasks.

Not certain from the listing — There is no mention of compliance certifications (e.g., SOC2, GDPR) or fine-grained access controls for the virtual employees acting on behalf of SMBs.

Enso operates as an AI agents marketplace. This introduces significant ecosystem risks, such as compromised or malicious third-party agents listed on the marketplace, cascading failures across multi-agent workflows, and trust abuse between different virtual employees.