GPT Researcher — agentic threat model

Allows users to connect any LLM of choice. This introduces risks of model misalignment, varying susceptibility to prompt injection, and inconsistent safety guardrails depending on the selected foundation model.

Supports hybrid research across local documents/files and web sources. This creates a high risk of data poisoning via malicious web content, and potential data exfiltration if local files are processed and sent to external LLM APIs.

Utilizes an autonomous orchestration framework to plan, outline, and execute parallelized research tasks. The integration of search engines and local file readers as tools exposes the framework to indirect prompt injection where untrusted web data hijacks the agent's execution flow.

Not certain from the listing — As an open-source tool, deployment is typically local or self-hosted. Without default sandboxing, a compromise of the agent process could lead to local file system exposure, privilege escalation, or theft of stored LLM API keys.

Not certain from the listing — While the description claims to address misinformation and reliability, it does not specify built-in real-time guardrails, logging, or observability features to detect adversarial manipulation or anomalous tool usage.

Not certain from the listing — Being a free, open-source research tool, it lacks centralized identity access management, enterprise compliance certifications (like SOC2), or built-in policy enforcement mechanisms, leaving security entirely to the deployer.

Supports multi-agent frameworks and parallelized agent operations. This introduces risks of cascading failures, trust abuse between sub-agents, and complex attack vectors where one compromised sub-agent manipulates the aggregation phase of the research report.