Matthew — agentic threat model

Not certain from the listing — likely relies on commercial LLMs for conversational capabilities. The primary threat is direct and indirect prompt injection via incoming customer messages (SMS, web forms) which could hijack the model's output or alignment.

Not certain from the listing — likely utilizes a RAG system or vector database containing business-specific FAQs, product details, or client intake guidelines. Vulnerable to data poisoning if malicious customer inputs are ingested into persistent memory, or data exfiltration of sensitive customer PII/PHI.

The agent orchestrates incoming messages across multiple channels (SMS, calls, forms) and triggers automated responses. Vulnerable to indirect prompt injection where an incoming message manipulates the orchestrator to execute unauthorized tool calls, such as sending spam texts or triggering unauthorized API calls to third-party platforms.

Not certain from the listing — likely hosted as a closed-source SaaS platform. Vulnerable to standard web application threats, API key exposure for communication gateways (e.g., Twilio), and lack of sandboxing for webhook processing.

Not certain from the listing — no mention of real-time guardrails, output filtering, or monitoring of conversational outputs. This creates a blind spot where the agent could generate toxic, hallucinated, or legally binding false promises to customers without detection.

The listing explicitly mentions use in 'healthcare' and 'real estate', implying the handling of highly regulated data (HIPAA, GDPR). However, there is no mention of compliance certifications, access controls, or audit logging, presenting a high risk of regulatory non-compliance.

Not certain from the listing — mentions integration with 'third-party platforms', which could expose the agent to cascading failures or trust abuse if integrated APIs or external agents are compromised.