1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. Pipedream presents open input channels, unrestricted code execution, broad credential access, and absent output filtering on its default configuration, with monitoring limited to plan-gated execution logs.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Pipedream carries moderate composite risk, with credential-brokering blast exposure and open input surfaces partially offset by per-workflow VM isolation.
Pipedream falls in the Exposed Giants quadrant with an Attack Surface of 5.18, Blast Radius of 6.00, and Defense Controls at 4 out of 15.
The table below presents the four headline scores on their respective scales, with Attack Surface and Blast Radius each measured out of 10 and Defense Controls out of 15.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 4.69 | Moderate composite risk driven by the gap between broad input and credential exposure on one side and minimal vendor-shipped controls on the other. |
| Blast Radius | 6 / 10 | Credential brokering across thousands of OAuth-connected apps, default-open outbound networking, and multi-language code execution within ephemeral VMs anchor the blast score. |
| Attack Surface | 5.18 / 10 | Open webhook triggers, unrestricted code execution, and MCP tool ingestion drive the midrange attack surface, with the trifecta-complete condition holding the floor. |
| Defense Controls | 4 / 15 | Per-workflow VM isolation is the primary vendor-shipped control; input guardrails, output guardrails, and centralized threat detection are absent on the default configuration. |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. Pipedream processes input from public webhooks, third-party app events, MCP tool calls, and REST API invocations, with arbitrary code execution available in every workflow step.
Higher scores indicate broader attacker-reachable input surfaces, with user input, external data, tool execution, orchestration, and inter-agent channels reaching the elevated tier.
Each row maps one of the ten canonical attack surfaces to its base score and a comment summarizing the documented exposure on the default configuration.
| Surface | Score | Comments |
|---|---|---|
| User Input | 3 / 4 | HTTP webhook endpoints accept arbitrary payloads on public URLs without mandatory authentication, with optional per-integration signature verification documented as a hardening measure [5]. |
| External Data | 3 / 4 | The MCP server ingests external content from more than ten thousand tool integrations and third-party app event sources into the workflow execution context [7]. |
| Memory | 2 / 4 | Data Stores provide cross-workflow key-value persistence with TTL support but lack integrity verification, atomic transactions, and cross-workflow access controls [10]. |
| Reasoning | 2 / 4 | Workflow logic follows author-defined code paths rather than LLM reasoning loops, with the String AI builder using vendor-selected models without documented reasoning controls [8]. |
| Planning | 2 / 4 | Workflows follow deterministic step sequences defined at authoring time, with the MCP sub-agent mode delegating planning decisions to the calling AI agent [7]. |
| Tool Execution | 3 / 4 | Workflow steps run arbitrary code in four languages with full package manager access for npm and pip within ephemeral per-workflow VMs on AWS [8]. |
| Orchestration | 3 / 4 | Workflows execute autonomously on event triggers, cron schedules, and API invocations without per-execution approval, with the open-source component registry hosting community actions [13]. |
| Inter-Agent | 3 / 4 | The MCP server connects external AI agents to thousands of app integrations with managed OAuth, and a sub-agent mode delegates tool configuration to a nested LLM [7]. |
| Output Processing | 2 / 4 | Workflow outputs pass through connected integrations without platform-level content sanitization, and environment variables separate secrets from code at rest [4]. |
| Configuration | 2 / 4 | Default configuration exposes public webhook URLs without authentication, and a transitive dependency CVE in the component registry demonstrates supply-chain risk at the platform layer [1][9]. |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Pipedream workflows create a direct exfiltration chain on the default configuration by ingesting untrusted webhook payloads, accessing OAuth credentials for thousands of integrations, and sending unrestricted outbound HTTP.
Pipedream exhibits all three of these conditions in its documented default configuration:
- Untrusted input — Workflows accept content from HTTP endpoints, app event sources, MCP requests, and REST API payloads without platform-level input filtering [5].
- Sensitive data — Connected account OAuth grants provide workflow access to email, CRM records, documents, source code, and credentials stored as environment variables [9].
- External egress — Workflows send unrestricted outbound HTTP to any URL by default and transmit data through connected account integrations without DLP controls [4].
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. A compromised Pipedream workflow reaches multi-language code execution within ephemeral VMs, OAuth-brokered access to thousands of connected accounts, and default-open outbound networking.
Higher blast scores indicate broader downstream impact from a single compromised workflow, with code execution, networking, and credential access at the elevated tier.
Each row maps a blast factor to the scope of damage a compromised workflow can inflict through that channel on the default configuration.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 3 / 4 | Ephemeral per-workflow VMs run multi-language code with full package manager access under user-level privileges within the documented isolation boundary [4]. |
| File system access | 2 / 4 | Workflow file access is scoped to the /tmp directory within the VM, with Data Stores providing cross-workflow key-value persistence but no direct host filesystem access [10]. |
| Network access | 3 / 4 | Outbound HTTP to any URL is unrestricted by default, with the VPC option providing static egress IPs as an opt-in Enterprise feature [4]. |
| Credential access | 3 / 4 | Managed OAuth grants are loaded into the workflow execution environment, providing API access to thousands of connected accounts through workspace-scoped controls [9]. |
| Autonomous action | 2 / 4 | Workflows fire on event triggers and cron schedules without per-execution approval, constrained to the authored step sequence rather than open-ended autonomous behavior [8]. |
| Deployment access | 1 / 4 | No direct infrastructure deployment capability exists; workflows interact with cloud APIs through integrations but lack built-in IaC or container orchestration tools [12]. |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. Pipedream ships per-workflow VM isolation as its primary defense control, while input filtering, output guardrails, and SIEM-integrated monitoring are absent or operator-managed on defaults.
Higher defense scores indicate stronger vendor-shipped safeguards, with execution isolation carrying the majority of the documented control investment.
Each row scores a defense component based on what the vendor implements by default versus what the operator must configure or build independently.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 0 / 3 | No platform-level prompt injection detection, input validation, or content filtering is documented; optional per-integration webhook signature verification is a hardening measure [5]. |
| Execution Isolation | 2 / 3 | Per-workflow VM isolation on AWS provides ephemeral workers with isolated RAM and disk, with SOC 2 and HIPAA BAA availability demonstrating vendor investment in the isolation tier [4][6]. |
| Action Controls | 1 / 3 | OAuth-scoped permissions and workspace admin controls are documented, but no per-action approval gate exists for workflow execution on the default configuration [9]. |
| Output Guardrails | 0 / 3 | No DLP, output content filtering, or exfiltration detection is documented on the default configuration; outbound data flows pass unmonitored to any destination [4]. |
| Monitoring | 1 / 3 | Event History captures per-workflow run data with filtering and replay capability, but retention varies by plan tier with no SIEM forwarding or anomaly detection [11]. |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Operators should prioritize input validation on webhook triggers, output filtering on outbound data flows, and SIEM integration to break the trifecta on the default configuration.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Require webhook signature verification on every production workflow trigger to reject unsigned payloads at ingestion.
- Configuration Configure HTTP trigger authentication settings to require API key or OAuth token validation before workflow execution begins.
- Engineering Deploy a pre-processing code step that classifies inbound payloads for injection patterns using the risk framework for AI features with untrusted input [3].
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Mandate VPC networking for all production workspaces to enforce network-level isolation with static egress IP controls.
- Configuration Configure workflow timeout limits and memory caps to constrain resource consumption within per-workflow VMs to the minimum required for each workflow.
- Engineering Instrument workflow code steps with execution-time and resource-usage monitoring to detect anomalous compute patterns within the VM boundary.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Require a manual approval step for workflows that write to production databases, send external messages, or modify source code repositories.
- Configuration Restrict connected account OAuth scopes to the minimum permissions required per workflow using the principle of least privilege.
- Engineering Build a proxy layer between Pipedream and sensitive integrations that enforces rate limits and action-type allowlists per workflow.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Require review of all outbound data flows from workflows handling sensitive data before promoting to production status.
- Configuration Enable VPC networking with static egress IPs to route outbound traffic through a network firewall that restricts destinations to approved endpoints.
- Engineering Implement a DLP scanning step that inspects outbound payloads for credential patterns, PII, and sensitive data markers before transmission.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Require all production workflows to maintain audit logs with retention periods meeting organizational compliance requirements.
- Configuration Forward Event History data to an external SIEM through a scheduled export workflow for centralized security monitoring and correlation.
- Engineering Build anomaly detection workflows that monitor execution frequency, error rates, and data volume patterns across production workflows and alert on deviations.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- Pipedream fastify dependency vulnerability report Community-reported transitive fastify CVE-2026-3635 in Pipedream component registry, closed after upstream patch
Selected Research
- Formalizing and Benchmarking Prompt Injection Attacks and Defenses USENIX 2024 prompt injection framework applicable to workflow automation agent input surfaces
- PIPE Prompt Injection Primer for Engineers Risk assessment guide for AI features with untrusted input and impactful functionality
Vendor Documentation
- Pipedream privacy and security documentation Vendor security overview documenting AWS hosting and VM isolation and SOC 2 compliance
- Pipedream security best practices Vendor guidance on webhook authorization and signature verification and credential handling
- Pipedream HIPAA compliance HIPAA eligibility with BAA availability for Enterprise customers
- Pipedream MCP server documentation MCP server exposing 10000+ tools with managed OAuth for AI agent integration
- Pipedream workflows documentation Core workflow architecture covering triggers and code steps and integration patterns
- Pipedream REST API authentication OAuth client credentials flow and user API keys and workspace-scoped access
- Pipedream Data Stores Persistent cross-workflow key-value storage with TTL and non-atomic operation warnings
- Pipedream Event History Centralized event history with status filtering and plan-dependent retention limits
Other Sources
- Workday acquisition of Pipedream announcement Enterprise context for Pipedream as integration platform acquired by Workday
- PipedreamHQ open-source component repository Public component registry with 11K GitHub stars and security contact disclosure