Interviewer.AI — agentic threat model
Interviewer.AI presents a moderate-to-high risk profile due to its processing of highly sensitive candidate PII and video data, coupled with the potential for algorithmic bias, prompt injection via resumes, and manipulation of candidate stack rankings.
OWASP AIVSS score rationale
| Autonomy of Action | 0.60 | |
| Goal-Driven Planning | 0.40 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.30 | |
| Persistent Memory | 0.50 | |
| Contextual Awareness | 0.50 | |
| Dynamic Identity | 0.10 | |
| Multi-Agent Interactions | 0.10 | |
| Non-Determinism | 0.60 | |
| Opacity & Reflexivity | 0.70 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — likely utilizes proprietary or third-party LLMs for generating job descriptions and interview questions. Primary threats include prompt injection via candidate resumes to manipulate screening outcomes, and model bias affecting candidate evaluations.
Not certain from the listing — processes high volumes of sensitive candidate data, including video recordings, resumes, and contact details. Key threats include data exfiltration of PII, unauthorized access to video storage, and data poisoning that could skew the stack-ranking algorithms.
Not certain from the listing — orchestration likely manages the workflow from job description creation to candidate ranking. Threats include insecure integration with Applicant Tracking Systems (ATS) and logic flaws in the automated shortlisting pipeline.
Not certain from the listing — hosted as a closed-source SaaS platform. Threats include insecure API endpoints, lack of robust tenant isolation, and potential exposure of cloud storage buckets containing candidate video interviews.
Not certain from the listing — claims to use 'explainable AI' but lacks details on continuous bias monitoring or drift detection. Threats include evaluation gaming (candidates optimizing resumes/answers to trick the AI) and undetected algorithmic drift in candidate scoring.
Not certain from the listing — must adhere to strict employment laws, GDPR/CCPA, and high-risk AI classifications under the EU AI Act. Threats include regulatory non-compliance due to automated decision-making without sufficient audit trails or bias mitigation.
Not certain from the listing — primarily operates as a standalone platform with API integrations into broader HR ecosystems. Threats include cascading failures or credential theft via compromised third-party ATS integrations.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).
These scores are auto-generated from public information (the agent's own listing, docs, and repository) using the canonical OWASP AIVSS formula and the MAESTRO framework — an estimate for guidance, not a penetration test, audit, or certification. See the scoring methodology. Are you the vendor? Factual corrections are free.