Recrubo.ai — agentic threat model

Not certain from the listing — likely utilizes commercial LLMs to analyze job descriptions and drive conversational pre-screening. Primary threats include prompt injection leading to bypassed qualification criteria or biased candidate evaluation.

Not certain from the listing — ingests vacancy details, CRM profiles, and candidate responses. Risks involve the exposure or exfiltration of candidate PII (GDPR/CCPA implications) and potential data poisoning of the profile enrichment pipeline.

Not certain from the listing — orchestrates the generation of sub-bots and coordinates ATS/CRM integrations. Vulnerabilities could allow unauthorized tool execution, such as manipulating interview schedules or writing fraudulent candidate data back to the ATS.

Not certain from the listing — likely deployed as a SaaS platform. Key threats include insecure API endpoints connecting to third-party ATS/CRM systems and inadequate sandboxing of the generated bot instances.

Not certain from the listing — requires robust guardrails and drift detection to ensure generated bots do not hallucinate job requirements or exhibit discriminatory behavior during candidate interactions.

The listing explicitly highlights validation by millions of users and full compliance with the EU AI Act, CCPA, and GDPR. This indicates strong baseline compliance controls around automated decision-making and candidate data privacy.

The system operates as a generator of specialized sub-bots ('instantly generates AI bots tailored for each role'). A compromise at the generator level could lead to a cascading supply-chain attack, deploying malicious or biased screening bots across all connected client ATS platforms.