1 Key Risks

The most critical security risks an operator inherits when deploying this agent in its documented default configuration. Breeze agents present a trifecta-complete input surface with moderate blast radius constrained by the absence of code execution and limited infrastructure access on default configuration.

2 AIRQ Scores

The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. The AIRQ composite captures Breeze's overall risk exposure from CRM-scoped agent operations on HubSpot's cloud platform.

Breeze lands in the Tight Operators quadrant with X = 4.80, Y = 3.75, and Z = 8, indicating moderate exposure offset by documented vendor controls.

Attack surface and blast radius are scored out of 10, defense controls out of 15, and the AIRQ composite out of 15.

3 Attack Surface

Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. Breeze's reasoning loop ingests natural-language prompts, uploaded documents, web content, CRM records, and MCP payloads as first-class input.

Higher scores indicate more attacker-reachable input surfaces; Breeze maxes at 2 across most axes due to class-level evidence only.

Each row maps a documented input surface to its base score and any evidence-driven penalty adjustment.

The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Breeze agents ingest untrusted visitor messages and uploaded documents, access CRM records containing customer PII, and send data outbound through MCP connections and customer chat responses.

4 Blast Radius

The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. A compromised Breeze agent reaches CRM records, OAuth-scoped external systems, and outbound email but cannot execute code or access operator infrastructure.

Higher blast scores indicate wider damage reach; Breeze peaks at 2 for network, credentials, and autonomous actions.

Each row maps a potential compromise outcome to its score based on documented agent capabilities and integration scopes.

5 Defense Controls

Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. HubSpot documents PurpleLlama input filtering, default-on approval gates, and audit logging while leaving execution isolation and output DLP to operator verification.

Higher defense scores credit stronger vendor-documented safeguards; lower scores flag operator-managed or undocumented controls.

Each component is scored on whether the vendor implements the control by default versus requiring operator configuration.

6 Hardening Tips

Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Operators should prioritize breaking the trifecta by restricting untrusted input channels and gating autonomous agent actions.

Input Guardrails

Input guardrails intercept adversarial content before it reaches the reasoning loop.

Execution Isolation

Execution isolation contains what a compromised agent can do on the host.

Action Controls

Action controls govern which tools and actions the agent can invoke autonomously.

Output Guardrails

Output guardrails inspect what the agent sends to other systems and users.

Monitoring

Monitoring captures what the agent did and surfaces anomalies for review.

7 References

The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.