Casper Practice Test — agentic threat model

Not certain from the listing — likely utilizes commercial LLMs or multimodal models to evaluate text and video responses. Threats include prompt injection to bypass scoring rubrics, adversarial inputs designed to artificially inflate scores, and potential model bias when evaluating subjective traits like empathy and ethics.

Not certain from the listing — processes and stores user-submitted video recordings, audio, and written responses. Threats include unauthorized access or exfiltration of sensitive user practice data, and potential data privacy issues if recordings are used for downstream model training without explicit consent.

Not certain from the listing — orchestration is likely limited to a linear workflow (presenting scenarios, managing timers, capturing inputs, and triggering evaluation APIs). Threats include insecure handling of user inputs during the evaluation phase.

Not certain from the listing — hosted as a web application. Threats include insecure storage of video/audio files (e.g., misconfigured S3 buckets) and lack of rate limiting on the AI scoring endpoints, which could lead to denial of service or high API costs.

Not certain from the listing — requires robust guardrails to ensure AI-generated feedback remains constructive, unbiased, and free of hallucinations. Threats include evaluation gaming, where users find specific keywords or structures that trick the AI into awarding high scores.

Not certain from the listing — handling video and audio recordings of users requires strict compliance with data privacy regulations (such as GDPR or CCPA). There is no mention of specific compliance certifications or data retention policies in the listing.

The listing does not describe any multi-agent interactions, external marketplace integrations, or collaborative agent ecosystems, making ecosystem-level threats currently out of scope.