qode — agentic threat model

Not certain from the listing — likely utilizes proprietary or third-party LLMs to generate interview questions, summarize notes, and match candidates. Key threats include prompt injection (candidates manipulating the AI recruiter to secure a pass) and inherent model bias affecting hiring decisions.

The agent ingests and stores massive candidate datasets ('billions of data points', 'candidate pool is yours to keep forever'). This presents severe threats of PII data exfiltration, unauthorized access to candidate profiles, and data poisoning of the matching database.

Not certain from the listing — likely uses a custom orchestration framework to manage the live interview flow and ATS-like data storage. Threats include state manipulation during live interviews and insecure tool integration with database APIs.

Not certain from the listing — hosted as a closed-source SaaS platform. Threats include container compromise, insecure database hosting of candidate records, and lack of network isolation for the live interview components.

Not certain from the listing — no mention of monitoring, bias audits, or guardrails. Gaps here could lead to undetected algorithmic drift, unfair candidate screening, and lack of auditability for hiring decisions.

Not certain from the listing — handling candidate PII and automated hiring decisions subjects the platform to strict regulatory frameworks (e.g., GDPR, CCPA, NYC Automated Employment Decision Tool law). Gaps in compliance and access control pose significant legal and security risks.

Not certain from the listing — primarily functions as a standalone ATS replacement. Ecosystem threats are low unless it integrates with external job boards or third-party sourcing agents.