Terri — agentic threat model
Terri presents a moderate risk profile primarily due to its integration with external CRMs and email systems, which could be leveraged for data exfiltration or social engineering if the voice-to-text pipeline is compromised via prompt injection.
OWASP AIVSS score rationale
| Autonomy of Action | 0.40 | |
| Goal-Driven Planning | 0.20 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.30 | |
| Persistent Memory | 0.30 | |
| Contextual Awareness | 0.40 | |
| Dynamic Identity | 0.10 | |
| Multi-Agent Interactions | 0.00 | |
| Non-Determinism | 0.50 | |
| Opacity & Reflexivity | 0.40 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — likely utilizes third-party speech-to-text (e.g., Whisper) and LLMs for structuring notes. Key threats include voice-based prompt injection (audio hijacking) and misaligned or hallucinated summaries of critical sales agreements.
Not certain from the listing — processes transient voice recordings and structured text before syncing to CRMs. Risks include insecure storage of raw audio files, lack of data-at-rest encryption, and potential leakage of sensitive customer data during processing.
Not certain from the listing — orchestrates the flow from voice input to CRM write actions and email drafts. Vulnerabilities include insecure tool integration with CRM APIs and lack of validation on structured outputs before they are pushed to external systems.
Not certain from the listing — relies on telephony/voice ingestion infrastructure and cloud hosting. Threats include interception of voice streams over PSTN/VoIP and insecure storage of CRM OAuth tokens or API credentials.
Not certain from the listing — no observability or guardrail mechanisms are detailed. This creates blind spots regarding transcription accuracy, potential prompt injections, or unauthorized data synchronization attempts.
Not certain from the listing — handles proprietary sales data and customer PII but does not declare compliance standards (e.g., SOC 2, GDPR). Risks include weak session management for mobile users and lack of audit trails for CRM modifications.
Not certain from the listing — interacts directly with third-party CRM ecosystems (e.g., Salesforce, HubSpot). Risks include API token abuse, cascading failures if CRM schemas change, and unauthorized data access within the connected enterprise environment.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).