WhatsApp — agentic threat model

Not certain from the listing — The underlying foundation model is not specified as this is an MCP server. However, the model's susceptibility to prompt injection is a critical threat vector, as an attacker could inject malicious instructions into a WhatsApp message that the model reads, triggering unauthorized actions.

The agent directly accesses highly sensitive personal data, specifically private chat histories and contact lists. The primary threat is data exfiltration of these private conversations to unauthorized third parties or LLM providers.

The agent exposes powerful tools (search history, read contacts, send messages) via the Model Context Protocol (MCP). Insecure tool integration or lack of strict input validation on the 'send message' tool could allow an LLM to spam contacts or send phishing links.

The MCP server connects to a personal WhatsApp account via the multi-device API. This requires storing and managing sensitive session credentials/tokens. Compromise of the hosting environment would expose these long-lived credentials, allowing full account takeover.

Not certain from the listing — There is no mention of built-in logging, auditing, or guardrails to monitor what messages are being read or sent, creating a significant blind spot for unauthorized automated actions.

The agent operates with the user's identity ('on the user's behalf') without explicit mention of OAuth, granular scopes, or human-in-the-loop (HITL) confirmation steps before sending messages, presenting a severe authorization and compliance risk.

If integrated into a multi-agent ecosystem, other untrusted agents could query this agent to read the user's private messages or trick it into sending messages, leading to cascading social engineering attacks.