JustCall AI Voice Agent — agentic threat model
The JustCall AI Voice Agent presents a moderate-to-high risk profile due to its direct integration with business-critical systems like CRMs and calendars, combined with its exposure to public telephony which makes it vulnerable to voice-based prompt injection (vishing).
OWASP AIVSS score rationale
| Autonomy of Action | 0.70 | |
| Goal-Driven Planning | 0.50 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.60 | |
| Persistent Memory | 0.50 | |
| Contextual Awareness | 0.70 | |
| Dynamic Identity | 0.20 | |
| Multi-Agent Interactions | 0.20 | |
| Non-Determinism | 0.60 | |
| Opacity & Reflexivity | 0.50 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — likely utilizes third-party or proprietary LLMs combined with Speech-to-Text (STT) and Text-to-Speech (TTS) engines. It is vulnerable to voice-based prompt injection (audio hot-word injection) and model hallucination during live calls.
The agent utilizes a customer-provided knowledge base to deliver contextual answers. This introduces risks of knowledge-base poisoning, where an attacker modifies the source documentation to force the agent to output malicious instructions or incorrect business information.
The agent orchestrates multi-step tasks including lead qualification, query routing, and appointment booking. Vulnerabilities include tool misuse, where an attacker manipulates the conversation to trigger unauthorized CRM updates or calendar spamming.
Not certain from the listing — presumably hosted on JustCall's cloud infrastructure. Key threats include insecure storage of CRM/calendar API keys and potential telephony-level denial of service (DoS) targeting the voice gateway.
Not certain from the listing — there is no mention of real-time conversational guardrails, transcription logging security, or drift monitoring to detect when the voice agent is being socially engineered or exploited by callers.
Not certain from the listing — details regarding data privacy compliance (e.g., GDPR, HIPAA for voice recordings), access controls for CRM integrations, and audit logging of agent actions are not specified.
Not certain from the listing — the agent appears to operate as a point solution integrating with external APIs rather than participating in a dynamic multi-agent ecosystem, minimizing cascading agent-to-agent trust risks.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).