Small print.
Wide open.

Table of Contents

with authorized access to our systems, model weights, or other sensitive information may be compromised after 
joining us, including due to efforts by state-sponsored actors, competitors, or others to recruit, bribe, coerce, or 
otherwise  induce  such  personnel,  or  to  compromise  their  credentials  or  devices,  in  order  to  misappropriate 
sensitive  information,  enable  unauthorized  access,  or  introduce  vulnerabilities  into  our  systems,  models,  or 
products. Because personnel with authorized access to our model weights and other core intellectual property 
are particularly attractive targets, and because our remote and distributed work environment and our reliance 
on third-party vendors for certain key processes may limit our visibility into such conduct, we may be unable to 
prevent  or  timely  detect  these  insider  threats.  In  addition,  in  certain  jurisdictions  in  which  we  operate  or  in 
which our vendors or the operators of facilities hosting our infrastructure are located, such personnel, vendors, 
or  operators  may  be  legally  compelled  to  cooperate  with  government  authorities,  including  intelligence  and 
security agencies, in ways contrary to our interests, such as by providing access to our systems, data, or model 
weights.  The  laws  of  those  jurisdictions  may  prohibit  the  affected  parties  from  notifying  us  of  such  demands 
and may afford us limited or no ability to challenge them, and because such cooperation may be lawful where it 
occurs  and  involves  personnel  acting  within  their  authorized  access,  our  insider-threat  and  other  security 
controls may not detect it.

We  have  also  seen,  and  expect  to  continue  to  see,  industry-wide  software  supply  chain  vulnerabilities  and 
attacks,  which  could  affect  our  or  third  parties’  systems,  or  the  security  of  our  models,  platform,  and 
applications. Geopolitical tensions or armed conflicts around the world may increase these risks. As a result, we 
may be unable to prevent or timely detect all attempts to access or exfiltrate sensitive information, including by 
actors with substantial technical, financial, or geopolitical resources.

As we continue to develop and deploy new features, including those incorporating AI, our systems are exposed 
to  additional  or  evolving  security  risks,  including  those  arising  from  emerging  or  imperfectly  understood  AI-
specific  threat  vectors.  Such  AI-specific  threats  include  prompt  injection  attacks  that  manipulate  model 
behavior  through  malicious  inputs,  attempts  to  replicate  or  reverse  engineer  our  proprietary  models  through 
systematic  API  queries,  adversarial  inputs  designed  to  cause  model  failures  or  misclassifications,  malicious 
corruption  of  training  data  that  could  compromise  model  integrity,  and  vulnerabilities  in  continuous 
integration and deployment pipelines that could allow insiders or other actors to inject malicious code that is 
subsequently  propagated  or  amplified  through  AI-assisted  development  workflows.  Such  attacks  may  be 
difficult  to  detect,  may  not  be  addressed  by  traditional  cybersecurity  defenses,  and  may  require  specialized 
expertise,  techniques,  and  infrastructure  to  mitigate.  Further,  features  that  rely  on  AI  may  be  particularly 
susceptible to unanticipated vulnerabilities as both our understanding and the broader market’s understanding 
of AI-related security risks and mitigation techniques continue to develop. Our efforts to mitigate the foregoing 
risks  may  result  in  false  positives  and  our  mistakenly  limiting  or  blocking  certain  users  from  accessing  our 
technology, which could result in potential litigation or regulatory action.

In  addition,  our  agentic  offerings  interact  with  external  tools,  APIs,  databases,  code  repositories,  and  other 
third-party systems, creating cybersecurity attack surfaces that are distinct from those applicable to traditional 
AI models. An adversary could manipulate the content of an external data source, API response, document, or 
web  page  processed  by  an  agent  to  cause  the  agent  to  take  harmful  or  unauthorized  actions  based  on  that 
manipulated input. An attacker could also attempt to compromise an active agent session and redirect the agent 
to  perform  malicious  actions  using  the  customer’s  authenticated  credentials  and  permissions.  Because  our 
agentic  offerings  are  designed  to  take  autonomous  actions  with  real-world  consequences,  including  executing 
code, modifying files, sending communications, and completing transactions, a successful exploitation of these 
agentic  attack  surfaces  could  result  in  data  exfiltration,  unauthorized  transactions,  code  injection,  or  other 
adverse  effects,  potentially  across  multiple  customer  deployments  simultaneously.  Traditional  cybersecurity 
defenses, including firewalls, input validation, and access controls, may not be fully effective against these novel 
threat  vectors,  and  the  security  community’s  understanding  of  agentic-specific  attack  surfaces  is  still 
developing.

We have in the past discovered, and may in the future discover, errors, vulnerabilities, or other defects, such as 
hallucinations, in our models, platform, and applications only after deployment, including in connection with 
the development of new features, integrations, or capabilities. Such issues have resulted and may in the future 
result  in  service  disruptions,  degraded  performance,  unintended  or  harmful  outputs,  or  the  unauthorized 
disclosure  of  personal  or  proprietary  information,  including  through  security  incidents  that  impact  the 
networks, systems, and data of our customers. In addition, incidents impacting our customers may be caused by 

89