Carly AI — agentic threat model

Not certain from the listing — likely relies on third-party foundation models to parse emails and draft responses. The primary threat is indirect prompt injection, where malicious instructions embedded in incoming emails hijack the model's behavior.

Not certain from the listing — processes highly sensitive user data including emails, calendar events, CRM records, and invoices. Gaps in data isolation or lack of encryption for cached email content could lead to severe data exfiltration.

The agent framework orchestrates complex workflows across 120+ integrations. Insecure tool integration is a critical threat, as an injected prompt could abuse tools to delete CRM records, send unauthorized emails, or exfiltrate files.

Not certain from the listing — operates as a closed-source SaaS. The infrastructure must securely store and manage API keys/OAuth tokens for 120+ integrations; credential theft or host compromise would grant attackers access to connected user accounts.

Not certain from the listing — no mention of guardrails or real-time monitoring. Without robust observability, unauthorized actions triggered by malicious emails (such as modifying invoices or CRM data) could go undetected.

Not certain from the listing — despite operating in highly regulated sectors like Healthcare and Education, there is no explicit mention of compliance standards (e.g., HIPAA, FERPA, SOC2) or fine-grained authorization policies.

Supports the creation of 'custom agents' and integrates with a vast ecosystem of external services. This introduces risks of cascading failures and trust abuse if custom agents inherit broad permissions or interact insecurely with third-party APIs.