Paths by which content the agent reads could lead to harm, and where each is controlled. Threat identifiers follow the OWASP Top 10 for LLM Applications (2025) where one applies.
Threat paths
docs [ "Documents and files<br/>drive, Box" ] -->| T1 | sb
web [ "Web pages and search results" ] -->| T1 | sb
conn [ "Connector responses<br/>your systems, Composio" ] -->| T1 | sb
skills [ "Skills<br/>editable by any member (P-04)" ] -->| T4 | sb
pkgs [ "Packages and URLs *<br/>fetched by agent code" ] -->| T4 | sb
sb [ "Agent sandbox<br/>model output steers the harness<br/>and the code it runs" ]
sb -->| T3 | files [ "Your files and tasks<br/>App authorizes each request" ]
sb -->| T3 | sys [ "Your systems via connectors<br/>App checks each tool call" ]
sb -->| T2 | ext [ "External destinations *<br/>egress setting open: no check (S-01)" ]
sb -->| T2 | int [ "Your internal networks *<br/>NetworkPolicy, except private upstream ranges via proxy" ]
sb -->| T5 | cred [ "Credentials<br/>no standing credential; per-file links" ]
sb -->| T6 | node [ "Node and other workloads *<br/>no hardened runtime class (S-09)" ]
sb -->| T8 | gw [ "Model gateway<br/>your gateway; filtering set by you" ]
Untrusted input Threat Documents and files (drive, Box) T1 Web pages and search results T1 Connector responses (your systems, Composio) T1 Skills, editable by any member (P-04) T4 Packages and URLs fetched by agent code * T4
What a manipulated agent can reach Threat Control Your files and tasks T3 App authorizes each request Your systems via connectors T3 App checks each tool call External destinations * T2 No check when the egress setting is Open (S-01) Your internal networks * T2 NetworkPolicy, except the private upstream ranges reachable through the proxy Credentials T5 No standing credential; per-file links (Credential handling ) Node and other workloads * T6 No hardened runtime class (S-09) Model gateway T8 Your gateway; filtering is set by you
Threats and controls
Threat Control Supported by the platform Depends on configuration Next step T1 Indirect prompt injection (LLM01) Server-side authorization limits what a manipulated agent can do; approvals when the agent’s preset or resource rules require them Yes Authorization is always enforced; the default preset for new agents asks for nothing (P-05) Set agent presets; content filtering at your model gateway T2 Sensitive information disclosure through exfiltration (LLM02) Egress setting: domain allowlist or workspace only Yes Open * when the egress setting is Open Set the egress setting to domain allowlist (S-01 to S-03) T3 Excessive agency (LLM06) Each request authorized within the agent’s permissions; per-call checks on connector tools; approvals Yes Enforced per request; see P-01, P-02, P-05 Close P-01 and P-05 T4 Supply chain (LLM03) Skills stored in the drive under authorization; package downloads depend on the egress setting Partly Package downloads unrestricted when egress is Open *; any member can edit organization skills (P-04) Domain allowlist; skill scanning (a production requirement to raise with Context) T5 Credential exposure No credentials for your data in sandboxes; App-brokered and edge-injected credentials Yes In effect, with the exceptions in Credential handling Per-sandbox log-shipping token (S-06); deny internal-only paths at the edge (S-05) T6 Sandbox escape Non-root, restricted container; optional hardened runtime class Partly No hardened runtime class * Expose the runtime class in the installer and provide gVisor or Kata on nodes (S-09) T7 Cross-user and cross-workspace access Authorization by the application tier Yes See the permissions reference See the permissions reference T8 Model provider risk Model access through your gateway Yes In effect You control filtering at the gateway
Finding IDs (S-xx, P-xx) are explained in Known issues and hardening .
