Marcus — agentic threat model

Not certain from the listing — likely utilizes commercial LLMs to generate personalized client follow-ups. Primary threats include prompt injection via incoming client emails, which could trick the model into marking invoices as paid or leaking sensitive financial data.

Not certain from the listing — ingests highly sensitive client payment histories, invoice details, and bank transaction records. Threats include data exfiltration of proprietary financial records and poisoning of payment history data to manipulate automated follow-up logic.

Orchestrates workflows connecting invoice tracking, email communication, and bank reconciliation. Insecure tool integration is a critical threat, where a compromised agent could abuse write-access APIs in Xero or Quickbooks to alter financial records.

Not certain from the listing — hosted as a closed-source SaaS. The primary infrastructure threat is the exposure or insecure storage of high-privilege OAuth tokens and API keys used to connect to bank accounts and accounting platforms.

Not certain from the listing — requires rigorous observability to monitor automated financial transactions and client communications. A lack of drift detection or guardrails could lead to undetected erroneous bank reconciliations or reputational damage from aggressive automated emails.

Handles sensitive financial and personally identifiable information (PII), triggering compliance requirements like GLBA, GDPR, or SOC 2. The listing does not mention mandatory human-in-the-loop (HITL) approvals for high-risk actions like bank reconciliation.

Not certain from the listing — operates within a broader ecosystem of accounting APIs (Xero, Quickbooks) and banking networks. Threats include cascading failures if upstream financial APIs change, or trust abuse if Marcus interacts with automated procurement agents on the client side.