Hey Caden AI — agentic threat model
Hey Caden AI is a low-to-moderate risk voice agent focused on SMB phone answering, where the primary security exposures involve voice-based prompt injection (vishing), potential exposure of customer PII in call transcripts, and unauthorized call routing.
OWASP AIVSS score rationale
| Autonomy of Action | 0.40 | |
| Goal-Driven Planning | 0.20 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.30 | |
| Persistent Memory | 0.20 | |
| Contextual Awareness | 0.40 | |
| Dynamic Identity | 0.10 | |
| Multi-Agent Interactions | 0.00 | |
| Non-Determinism | 0.50 | |
| Opacity & Reflexivity | 0.50 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — likely relies on third-party speech-to-text, LLM, and text-to-speech models. It is vulnerable to voice-based prompt injection (vishing) where callers attempt to hijack the system's instructions or elicit unauthorized information.
Not certain from the listing — likely stores business-specific FAQs, operating hours, and customer call transcripts. Risks include unauthorized access to call logs containing customer PII and potential poisoning of the business knowledge base.
Not certain from the listing — likely uses a simple conversational state machine or voice gateway orchestration. Vulnerabilities include insecure integration with external booking tools or calendars, allowing malicious callers to manipulate appointments.
Not certain from the listing — hosted as a cloud-based SaaS. Vulnerabilities include standard web application risks, SIP/VoIP infrastructure exposure, and potential eavesdropping on unencrypted voice streams.
Not certain from the listing — likely provides basic call history and transcripts to the business owner, but lacks advanced real-time guardrails to detect and block adversarial voice inputs or toxic agent outputs.
Not certain from the listing — as a closed-source, paid service for SMBs, it does not explicitly document compliance with standards like SOC2, HIPAA, or PCI-DSS, which may be critical depending on the business vertical.
Not certain from the listing — operates primarily as a standalone vertical solution with minimal multi-agent interaction, though it may integrate with external SMB software ecosystems (CRMs, scheduling tools).
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).