Epicenter — agentic threat model

Not certain from the listing — The specific foundation models used by Epicenter are not disclosed. However, any underlying LLM used to process or summarize shared memory is susceptible to indirect prompt injection via malicious data ingested from connected applications.

Epicenter's core value proposition is cross-application memory. This introduces severe data operations risks, including memory/knowledge-base poisoning, data exfiltration of sensitive user context across application boundaries, and embedding inversion if vector databases are used without encryption.

As a memory framework, Epicenter is vulnerable to memory poisoning and state manipulation. If the framework lacks strict validation of the memory payloads received from or sent to external applications, malicious inputs can hijack the agentic workflow.

Not certain from the listing — While tagged as open source, the deployment architecture (local storage vs. cloud-hosted database) is unspecified. If stored locally, insecure file permissions could expose the memory; if cloud-hosted, exposed API endpoints and credential theft are primary threats.

Not certain from the listing — There is no mention of observability, logging, or guardrails to monitor what is being written to or read from the shared memory, creating a blind spot for detecting memory poisoning attacks.

Not certain from the listing — The listing does not detail access control policies, authentication mechanisms, or compliance standards (such as GDPR/CCPA regarding the 'right to be forgotten' for persistent shared memory).

By sharing memory across different applications, Epicenter establishes an implicit ecosystem trust boundary. A compromise or malicious input in one connected application can propagate poisoned memory to all other connected applications, leading to cascading trust abuse.