KaiCalls — agentic threat model

Not certain from the listing — likely relies on commercial LLMs for speech-to-text, intent parsing, and text generation. Vulnerable to voice-based prompt injection (VUI) or SMS-based injection, which could manipulate the agent's routing logic or response content.

Not certain from the listing — processes and stores call transcripts, SMS history, and contact details. Vulnerable to unauthorized access or exfiltration of sensitive customer conversations and PII.

Orchestrates call routing, SMS dispatch, and follow-up tasks. Vulnerable to tool misuse where an attacker manipulates the agent via conversation to send unauthorized SMS messages or route calls to external, malicious numbers.

Not certain from the listing — requires integration with telephony infrastructure (e.g., Twilio or SIP trunking). Vulnerable to API key exposure, webhook hijacking, or unauthorized access to the hosting environment.

Not certain from the listing — requires robust logging of call flows and SMS history to detect anomalies, toll fraud, or spamming behavior. Lack of visibility could lead to undetected abuse of the business phone number.

Handles communication data subject to privacy regulations (GDPR, CCPA) and telecom regulations (TCPA). The listing does not specify built-in compliance controls, access controls, or audit logging for call recordings.

Not certain from the listing — primarily functions as a standalone virtual secretary, but may interact with external CRMs or calendar systems to perform follow-up tasks, introducing integration trust risks.