Hume AI — agentic threat model

Hume AI relies heavily on proprietary expression measurement models, LLMs, and text-to-speech (TTS) engines. Key threats include adversarial audio/visual inputs designed to spoof emotional states, model stealing of their specialized empathic weights, and prompt injection via voice commands.

Not certain from the listing — The platform processes highly sensitive biometric data (voice and facial expressions). If RAG or vector databases are used to store user interaction history, they face risks of data exfiltration and unauthorized access to intimate user profiles.

Not certain from the listing — The orchestration framework managing the Empathic Voice Interface (EVI) and Custom Model API is proprietary. Vulnerabilities could exist in how dialogue state is managed or how the API handles concurrent multimodal streams.

Not certain from the listing — As a closed-source, paid API platform, it likely runs on cloud infrastructure. Threats include API key exposure, denial of service (DoS) targeting real-time voice processing, and potential container escape if custom models are run in multi-tenant environments.

Not certain from the listing — While the description mentions aligning AI with human well-being, specific guardrails or real-time monitoring systems to detect emotional manipulation, toxic TTS generation, or biometric spoofing are not detailed.

Not certain from the listing — Processing facial and vocal expressions triggers strict biometric privacy regulations (e.g., BIPA, GDPR). The listing does not specify compliance certifications, data deletion policies, or user consent frameworks.

Not certain from the listing — Hume AI is positioned as an API platform rather than a multi-agent marketplace. However, if integrated into third-party agent ecosystems, compromised downstream agents could abuse Hume's empathic interface to socially engineer users.