ShowAndTell AI — agentic threat model

Not certain from the listing — The underlying foundation models are unspecified. Key threats include model hallucinations or misaligned outputs generating incorrect medical/dental advice, and adversarial prompt injection by patients seeking to manipulate treatment plan explanations.

Not certain from the listing — The agent processes highly sensitive dental treatment plans and patient data. This introduces severe risks of Protected Health Information (PHI) exfiltration, data leakage, and unauthorized access to patient records if RAG or vector databases are insecurely implemented.

Not certain from the listing — The orchestration framework is closed-source. Risks include insecure tool integration with dental practice management software (e.g., scheduling, charting systems) and memory poisoning where malicious patient inputs alter the agent's behavioral state.

Not certain from the listing — Infrastructure details are proprietary. Compromise of the hosting environment could lead to lateral movement into dental practice networks or unauthorized API access to clinical databases.

Not certain from the listing — There is no mention of clinical guardrails, output filtering, or continuous observability. Gaps here could allow the agent to output harmful or legally non-compliant medical advice without detection.

Not certain from the listing — Despite operating in healthcare, the listing does not explicitly cite HIPAA compliance, SOC2 audits, or specific identity and access management (IAM) controls for dental staff vs. patients.

Not certain from the listing — It is unclear if the agent interacts with other automated systems (e.g., billing or external insurance APIs). If so, cascading failures or unauthorized automated transactions could occur.