Capability Overview
MoEngage, the Indian customer engagement platform serving 1,350+ brands across 75 countries, has acquired San Francisco-based Aampe to embed a dedicated AI agent for every individual customer it tracks. Rather than segmenting audiences into cohorts and applying campaign rules, Aampe’s architecture assigns each end-user their own agent that continuously learns from behavioral signals and autonomously decides what message to send, through which channel, and when. At MoEngage’s scale, this means millions of simultaneously operating autonomous agents processing sensitive behavioral and personally identifiable data for brands in financial services, retail, food delivery, and media.
For defenders, the significance is not the marketing pitch — it is the architectural shift. Centralised campaign rules have a defined, auditable logic. Millions of per-user agents operating with learned, opaque policies do not.
Attack Surface Analysis
Behavioral Data Poisoning Agents learn from customer interactions. An adversary capable of injecting synthetic or manipulated behavioral signals — through fake app interactions, click fraud, or compromised SDKs — can skew agent decision-making at scale. At mass deployment, even a low-rate poisoning campaign could systematically suppress or redirect communications for targeted user cohorts.
Excessive Agency at Scale Each agent makes autonomous decisions without a human approval step. This is the intended design. However, it means a single misconfiguration, adversarial input, or policy injection propagates instantly across millions of decision points. There is no human gate to catch anomalous output before it reaches end customers.
PII Aggregation and Exfiltration Risk Per-customer agents accumulate fine-grained behavioral profiles. A platform-level breach or misconfigured API endpoint exposes not just a segment dataset but rich, individualised profiles for every tracked user. The exfiltration value is substantially higher than traditional segment-based marketing databases.
Supply Chain Risk from Acquisition Integration Merging Aampe’s codebase and infrastructure into MoEngage creates a transitional supply chain window. Two previously separate authentication systems, data pipelines, and model training workflows must be reconciled. This integration period historically introduces misconfigurations, credential exposure, and unreviewed code paths.
Cross-Tenant Data Leakage Shared agent infrastructure serving 1,350 brands across industries raises multi-tenancy isolation concerns. Insufficient boundary enforcement could allow behavioral signals or profile data to bleed between brand tenants, with particular sensitivity in regulated sectors like financial services.
Framework Mapping
- AML.T0020 / LLM03 (Training Data Poisoning): Agent learning loops are directly manipulable via adversarial behavioral inputs.
- AML.T0051 / LLM01 (Prompt Injection): If agent policies or goals are expressed as configurable natural-language instructions, partial platform access could enable policy injection.
- LLM08 (Excessive Agency): The core product feature — full autonomy over send decisions — is the textbook excessive agency risk scenario.
- AML.T0010 / LLM05 (Supply Chain Compromise): Acquisition integration creates a meaningful supply chain exposure window.
- AML.T0057 / LLM06 (Data Leakage): Per-customer agent profiles represent a concentrated, high-value PII target.
Threat Scenarios
Scenario 1 — Targeted Suppression via Poisoning: A threat actor with access to a brand’s event ingestion pipeline injects null or misleading behavioral events for a targeted user segment (e.g., high-value financial customers). Agents trained on poisoned signals suppress re-engagement messages, causing measurable churn without triggering traditional security alerts.
Scenario 2 — Malicious Policy Injection: An insider or compromised administrator account modifies agent configuration templates. Because agents apply policies autonomously to millions of users, a single change propagates a manipulated message or offer to a large population before detection.
Scenario 3 — Bulk PII Harvest via API Misconfiguration: During post-acquisition infrastructure consolidation, an unreviewed API endpoint exposes per-agent customer profiles. An external actor enumerates profiles across tenants, harvesting behavioral and contact data for multiple enterprise brands in a single operation.
Defender Checklist
- Map all data ingestion points feeding agent learning loops; assess each for external manipulation risk
- Request MoEngage’s multi-tenant isolation architecture documentation and independent penetration test results
- Identify all autonomous agent actions that touch regulated data categories (financial, health) and require human approval gates
- Monitor for anomalous messaging volume or pattern changes that could indicate agent policy tampering
- Include Aampe integration milestones in vendor security review cycles; treat the integration period as elevated-risk
- Evaluate data retention and deletion capabilities for per-customer agent profiles against GDPR/DPDP obligations
- Test API authentication boundaries between brand tenants before expanding platform usage