Perplexity — agentic threat model
Perplexity presents a moderate risk profile primarily driven by its real-time web-scraping and RAG capabilities, which are susceptible to data poisoning and prompt injection, though its lack of write-access to external systems limits its direct operational impact.
OWASP AIVSS score rationale
| Autonomy of Action | 0.20 | |
| Goal-Driven Planning | 0.30 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.40 | |
| Persistent Memory | 0.20 | |
| Contextual Awareness | 0.60 | |
| Dynamic Identity | 0.10 | |
| Multi-Agent Interactions | 0.10 | |
| Non-Determinism | 0.50 | |
| Opacity & Reflexivity | 0.40 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — Perplexity uses advanced closed-source and open-source LLMs. Threats include prompt injection, model reprogramming, and adversarial inputs designed to bypass safety filters.
Perplexity relies heavily on real-time web scraping and RAG. This exposes it to data/knowledge-base poisoning (SEO manipulation, adversarial web pages) and data exfiltration via prompt injection.
Not certain from the listing — The orchestration layer manages query planning and tool execution (search APIs). Threats include insecure tool integration and prompt injection leading to unintended search queries.
Not certain from the listing — Hosting and sandboxing details are not provided. The web scraping infrastructure is highly vulnerable to SSRF, IP blocking, and potential container compromise if executing untrusted JS from scraped sites.
Not certain from the listing — No details on monitoring or guardrails are provided. Gaps here could lead to undetected drift, hallucinated answers, or undetected prompt injection attacks.
Not certain from the listing — Compliance certifications (e.g., SOC2, ISO) and identity/auth policies are not mentioned, leaving potential gaps in user data privacy and access controls.
Not certain from the listing — No multi-agent or marketplace interactions are described, though future integrations could introduce cascading trust issues.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).