Phoenix AI Assistant — agentic threat model

Not certain from the listing — likely utilizes commercial LLMs to power its conversational AI. Primary threats include prompt injection via customer inputs, which could reprogram the agent to bypass organizational instructions or output mis-aligned/harmful content.

Not certain from the listing — relies on uploaded instructions and contextual materials for training. Threats include data poisoning of these reference materials by unauthorized users and potential exfiltration of sensitive customer data stored in interaction histories.

Not certain from the listing — orchestrates task execution and conversational flows across multiple channels. Vulnerable to indirect prompt injection where malicious emails or Slack messages trigger unauthorized digital tasks or tool misuse.

Not certain from the listing — hosted as a closed-source SaaS platform. Threats include the compromise of API keys and credentials used to connect to external communication channels (Slack, email, telephony providers).

Not certain from the listing — mentions 'under human supervision' for task execution, but lacks details on automated guardrails, logging, or drift detection to monitor conversational quality and prevent abuse.

Not certain from the listing — closed-source paid platform. Requires robust role-based access control (RBAC) to manage who can upload training instructions, but specific compliance certifications (e.g., SOC2, GDPR) are not cited.

Not certain from the listing — deploys virtual agents across various channels. Risks include trust abuse if a compromised external channel agent is used to pivot and execute malicious actions inside internal communication channels like Slack.