Cara — agentic threat model

Not certain from the listing — The underlying foundation models are unspecified. However, because Cara processes untrusted natural language inputs from public phone calls and emails, it is highly susceptible to indirect prompt injection, adversarial manipulation, and goal hijacking.

Cara draws from account-specific knowledge and integrates with AMS/CRM systems. This creates a high risk of unauthorized data exfiltration of sensitive policyholder PII or proprietary agency data if the RAG system is manipulated via prompt injection.

The agent orchestrates workflow automation, email/phone triage, and COI generation. Insecure tool integration with CRM/AMS APIs could allow an attacker to trigger unauthorized policy modifications, fraudulent COI generation, or spam dissemination.

Not certain from the listing — The hosting environment is described generally as a 'cloud-based unified panel' with 'branded deployment'. Specific containerization, network isolation, or secrets management practices for CRM API keys are not detailed.

Not certain from the listing — There is no mention of real-time guardrails, transaction monitoring, or logging mechanisms to detect anomalous behavior, prompt injection attempts, or drift in the automated workflows.

Not certain from the listing — Despite operating in the highly regulated finance and insurance sector, the listing does not explicitly cite compliance certifications (such as SOC 2, GLBA alignment, or ISO 27001) or detail its access control policies.

Cara is designed to collaborate across a multi-user ecosystem including customers, teammates, and external carriers. This multi-party trust boundary increases the risk of privilege escalation, where a customer-level interaction could manipulate the agent into performing carrier-level or teammate-level actions.