Inari — agentic threat model
Inari presents a moderate-to-high risk profile due to its deep integrations with critical business systems like CRM, Jira, Slack, and Linear. A compromise or successful prompt injection via untrusted customer feedback could lead to unauthorized data exfiltration or manipulation of the product backlog.
OWASP AIVSS score rationale
| Autonomy of Action | 0.50 | |
| Goal-Driven Planning | 0.40 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.60 | |
| Persistent Memory | 0.60 | |
| Contextual Awareness | 0.70 | |
| Dynamic Identity | 0.20 | |
| Multi-Agent Interactions | 0.10 | |
| Non-Determinism | 0.50 | |
| Opacity & Reflexivity | 0.50 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — the specific LLMs used by Inari are not disclosed. Potential risks include prompt injection via untrusted customer feedback inputs, leading to misaligned prioritization or data leakage.
Inari ingests data from CRM, Slack, Jira, Linear, and customer feedback. Risks include data poisoning (injecting malicious feedback to skew prioritization) and unauthorized data exfiltration of sensitive customer or company analytics.
Not certain from the listing — the orchestration framework is proprietary. Risks include insecure tool integration with Jira/Linear APIs, where manipulated prompts could trigger unauthorized ticket creation, modification, or deletion.
Not certain from the listing — hosting details are not provided. Standard risks include insecure storage of API keys/secrets for Slack, Jira, and CRM integrations, and lack of isolation between tenant data in this closed-source SaaS.
Not certain from the listing — no mention of built-in guardrails or evaluation frameworks. Risks include blind spots in detecting adversarial prompt injections embedded within customer feedback or CRM notes.
Not certain from the listing — compliance certifications (e.g., SOC2, GDPR) are not specified. Risks include lack of granular access controls, potentially allowing any user to access sensitive CRM data pulled by the agent.
Not certain from the listing — no explicit multi-agent interactions are described. However, integrating with Slack and Jira exposes it to ecosystem risks if other malicious bots or compromised integrations interact with it.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).