Coach Nova — agentic threat model

Not certain from the listing — likely relies on commercial LLMs prompted with psychological principles. Risks include prompt injection leading to harmful/unsafe mental health advice or jailbreaks bypassing safety guardrails.

Not certain from the listing — likely utilizes a vector database (RAG) containing psychological frameworks and stress-relief strategies. Risks include data poisoning of the coaching knowledge base or exfiltration of sensitive user conversation history.

Not certain from the listing — likely uses a standard conversational framework with memory management to maintain user context. Risks include memory poisoning where malicious user inputs alter the agent's long-term coaching persona.

Not certain from the listing — deployed as an API-based cloud service. Risks include insecure API endpoints allowing unauthorized access to private employee chat logs or tenant isolation failures in a multi-tenant enterprise setup.

Not certain from the listing — requires strict guardrails and sentiment analysis to detect self-harm or severe clinical depression. Risks include blind spots in detecting crisis situations, leading to inadequate or dangerous automated responses.

Not certain from the listing — handles highly sensitive workplace wellness and mental health data, raising significant GDPR, HIPAA, and workplace privacy compliance risks. Lack of explicit compliance certifications in the listing is a concern.

Not certain from the listing — primarily operates as a standalone conversational companion. Risks are low here unless integrated into broader HR multi-agent systems where it could leak sensitive employee sentiment data.