--- title: "Know what the platform defends" description: "The Duale AI threat model states where untrusted text enters the model context, what the platform bounds, and what your integration must add." lang: en status: public-preview lastUpdated: 2026-09-04 url: https://duale.ai/en/docs/security/threat-model --- ## AI-generated summary Names six sources of untrusted text reaching an agent's context, states platform bounds and gaps, and gives the rule to treat retrieved text as hostile. - Names six untrusted text sources feeding the model context, from Library documents to model output. - States no platform guarantees prompt-injection prevention; the rule is to treat retrieved text as hostile. - Lists platform bounds: task deadlines, delegation limits, model-interaction ceilings, document reach, and sandbox isolation. - States the platform provides no per-action authorization, no human approval step, and no prompt-injection filter. - Describes blast radius of leaked credentials, from one agent token to a provider credential. Summaries were generated by AI. Generative AI is experimental. --- Your agent reads text that other people wrote, and some of that text tries to steer it. This page states where that text enters, what the platform bounds, what it does not, and what you own as a result. Behavior here was checked against the shipped platform on 2026-08-31. It is current behavior, not a commitment. This page uses **task** for the end-to-end request, **delegated task** for work handed to another agent, and **model interaction** for one model request and response inside either task. ## Where text you do not control enters Each source below reaches the model as ordinary text. You wrote none of it at the moment the model reads it. | Source | Written by | | --------------------------------------- | ---------------------------------------------- | | A document in a Library | Whoever produced the document | | A search-result title or extract | A publisher and the upstream search system | | A web page an agent fetched | Whoever runs that site | | The result your tool returned | Your code, and whatever your code read | | The output of a program the model wrote | The program | | Earlier model output in the task | The model, possibly acting on any of the above | The last row separates this from ordinary input validation. Every source feeds one context, and what the model does next feeds that same context again: ```mermaid flowchart LR accTitle: How text an outsider wrote reaches the model and comes back as an action accDescr { Six sources feed the model's context: a document in a Library, a search result title or extract, a web page an agent fetched, the result your tool returned, the output of a program the model wrote, and earlier model output. The model reads that context and chooses the next step, which can invoke one of your tools, fetch another page, or run another program. Each of those writes its result back into the context, so text that arrived in one model interaction keeps steering later interactions. } Doc[A document in a Library] Search[A search title or extract] Web[A web page an agent fetched] Tool[The result your tool returned] Prog[The output of a program the model wrote] Model[Earlier model output] Ctx[The model's context] Next[The model chooses the next step] Act[Calls your tool, fetches a page, or runs a program] Doc --> Ctx Search --> Ctx Web --> Ctx Tool --> Ctx Prog --> Ctx Model --> Ctx Ctx --> Next Next --> Act Act --> Ctx ``` Text that steers the model early in a task can keep steering it until the task ends. ## Prompt injection is not solved, here or anywhere **The platform does not identify and remove embedded instructions before it gives extracted text to the model.** Extraction can change the format or omit content; it is not a security filter. No platform can guarantee prevention. [OWASP Top 10 for LLM Applications 2025, LLM01: Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) states that no foolproof prevention method is known. The UK NCSC article [Prompt injection is not SQL injection](https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection) calls a language model an inherently confusable deputy. It says to reduce the risk and impact instead of claiming to remove them. Both sources were checked on 2026-08-31. One rule follows: **Treat every retrieved passage, search extract, and fetched page as hostile data.** Put your controls in your tool code, where they run deterministically. A system instruction saying "do not delete records" is a preference. A check inside the tool that deletes records is a control. [Secure integration](https://duale.ai/en/docs/security/secure-integration.md) shows where those checks go. Duale AI publishes no measured prompt-injection resistance rate. Your assessment must also cover the model providers you select, the tools you write, and every external service those tools call. ## Three properties together trigger this gate For prompt-injection risk, put a human decision or deterministic check before an external action when the agent has all three properties: 1. It reads content you do not control. 2. It can reach data that matters. 3. It can change something outside the platform, or send a message. ```mermaid flowchart LR accTitle: The three properties that together require a gate accDescr { Three properties combine. The agent reads content you do not control. The agent can reach data that matters. The agent can change something outside the platform or send a message. An agent holding all three needs a human decision or a deterministic check before it acts outside the platform. Removing any one property removes this prompt-injection-driven condition, but it does not remove every approval need. } Reads[Reads content you do not control] Reaches[Reaches data that matters] Acts[Changes something outside the platform] Gate{All three at once} Need[Needs a human decision or a deterministic check first] Safe[This combined condition no longer applies] Reads --> Gate Reaches --> Gate Acts --> Gate Gate -->|yes| Need Gate -->|one property removed| Safe ``` Removing one property removes this prompt-injection condition. It does not remove a legal, financial, or business approval requirement. If an agent needs all three properties, add the gate before it acquires the last one. ### Remove one property instead You can also remove one property: | Move | Effect | | ------------------------------------- | ----------------------------------------------------------------------------------------- | | Split the work across two agents | One reads content you do not control, one holds the tool that acts. Neither has all three | | Narrow the grant | An agent that cannot reach the sensitive Library loses property two | | Make the tool propose rather than act | The agent writes a proposal record, and a separate process executes accepted ones | The third move also survives a replayed tool call. ## What the platform bounds These bounds hold with no configuration from you. None of them decides whether an action is allowed. Each one limits how far work runs, or how far it reaches. | Bound | Effect | | ------------------------- | ------------------------------------------------------------------------------------------------------------ | | Task deadline | An absolute time ends the task with a failure instead of letting it continue | | Delegation depth | Delegated tasks can nest only to a fixed depth that you do not set | | Delegation fan-out | One model interaction can start only a bounded number of delegated tasks | | Model-interaction ceiling | One agent cannot make unlimited model interactions, even when it does not repeat itself | | Event addressing | One agent's task events are unreachable from another agent | | Document reach | An agent reads only Libraries its identity was granted | | Sandbox state | Each code run gets fresh writable state, and the next run does not receive it | | Sandbox network | Outbound access starts off for each code run | | Sandbox time and memory | The model chooses within fixed ranges; [Agent harness](https://duale.ai/en/docs/agent-harness.md) owns the ranges and defaults | | Upload scanning | Every file is scanned before extraction, and the scan fails closed | The fixed work ceilings reduce the [unbounded-consumption risk described by OWASP](https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/). They do not replace your own admission, concurrency, deadline, or spend controls. You can verify the upload scan in a non-production Library with the [official EICAR anti-malware test file](https://www.eicar.org/download-anti-malware-testfile/). The document must end in `failed` with `MALWARE_DETECTED`, and no text from it must become searchable. [Manage a Library](https://duale.ai/en/docs/sdk/manage-libraries.md) states the integrity and malware outcomes to check. ## Controls your integration must add Each item below is a control a reader assumes exists. - **No per-action authorization.** The platform checks that your agent can call your tool. It does not check whether this call, with these arguments, is one you want to allow. - **No human approval step.** The platform builds none. Your integration must obtain the decision, and your tool code must enforce it before a side effect. - **No tool allowlist per request.** A task cannot narrow the tools available to its coordinating agent. The dedicated Web research executor has a separate fixed tool surface and cannot call your registered tools. - **No prompt-injection filter for what an agent reads.** Extracted document text, search extracts, and extracted page text can carry third-party instructions into the model context that reads them. - **No guarantee that a browsed page cannot influence later work.** Raw page text stays in the Web research context, but its condensed synthesis returns to the coordinating agent and can affect a later tool call. - **No undo.** Stopping a task prevents new work. A call already sent to a provider or a tool runs to its end. Assume that every absence applies. Authorize each call in your tool code. Put approval before high-impact effects. Register only the tools the agent needs. Treat retrieved text as hostile. Make side effects idempotent and add a compensation path. [Secure integration](https://duale.ai/en/docs/security/secure-integration.md) shows where those controls run. ## What Web content and a program in the sandbox can reach Web research starts a fresh, dedicated executor with only the bounded research brief. It does not inherit the parent conversation or document history, cannot call your registered tools, and cannot delegate. Raw search results and page content stay in that research context. The coordinating agent receives a condensed package of claims, sources, excerpts, and gaps. This separation reduces the direct reach of hostile page text; it is not a content filter. A page can still steer the researcher's synthesis, and that synthesis can affect later work by the coordinating agent. Keep approval in the code that owns each external effect. Related page reads by the research executor can carry cookies and site storage. Treat that state as sensitive. Page access does not support sign-in. [Web page access](https://duale.ai/en/docs/web/page-access.md) states the browser boundary. [Data protection](https://duale.ai/en/docs/security/data-protection.md) states how long saved state can remain. Page access renders active content. A page or page resource can send additional network requests while it renders, including non-GET requests. A control in your registered tool protects only that tool. It does not authorize or block requests that page JavaScript sends. **A model-written program gets fresh writable state.** The platform destroys that state when the code run ends, so nothing the program leaves behind reaches the next run. The program receives its code, packages, and the environment variables the model supplies. It receives none of your process, credentials, or network. Outbound network starts off for each run. When the model turns it on and names no domains, the program reaches its language's package registry and nothing else. When the model names domains, it reaches those. The platform can reuse one package snapshot when separate tenants request the same package set. Read the boundary above as separation from your environment and between the writable state of two runs. Do not read it as a dedicated-tenant sandbox boundary. Preparing a package snapshot can reach public package registries on a cache miss. This happens outside the code run, so the run's network setting does not govern it. ## Blast radius of one leaked credential **Reading your model-provider configuration returns the provider credential values.** Grant that read as you would grant a secret. | Leaked | Reaches | | ------------------------------------------ | ----------------------------------------------------------------------------------------------- | | One agent API token | That agent's tasks, tools, and the Libraries it can read. Not another agent, not another tenant | | A person's credential with the editor role | Every agent in the tenant, and your model-provider configuration including its credentials | | A person's credential with the viewer role | Your model-provider configuration including its credentials | | A provider credential | Whatever that provider account allows, until you revoke it at the provider | [Agents and access](https://duale.ai/en/docs/agents-and-access.md) states which roles carry that read. Revoking an agent token stops new requests. It does not stop a task already running, which can run for days. Return to [Security](https://duale.ai/en/docs/security.md) to place this threat model in the lifecycle of one task. ## Related content - [Protect data across every boundary](https://duale.ai/en/docs/security/data-protection.md) - [Secure your use of the platform](https://duale.ai/en/docs/security.md) - [Intended purpose, excluded uses, and behavioral constraints](https://duale.ai/en/docs/scope-and-limits.md) - [Terms of use for AI agent orchestration](https://duale.ai/en/legal/cgu.md) - [Govern AI agents while they move to production](https://duale.ai/en/solutions/governance.md) - [Legal terms, privacy policy, and subprocessors](https://duale.ai/en/legal.md) --- ## Sitemap See the full [Markdown sitemap](https://duale.ai/sitemap.md) for all pages.