1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. Ada's default configuration accepts untrusted input from multiple channels, grants authenticated write access to external systems, and relies on operator-managed monitoring with no documented anomaly detection.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Ada's composite profile balances vendor-documented defenses against a trifecta-elevated attack surface and a narrowly scoped blast radius.
Ada occupies the Tight Operators quadrant, reflecting an attack surface below the midpoint, a blast radius well below the severity threshold, and moderate defense controls.
Each axis is scored against its maximum: Attack Surface out of ten, Blast Radius out of ten, Defense Controls out of fifteen, and AIRQ as the composite.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 2.13 | The low composite reflects a limited blast radius amplified by moderate defenses, against an attack surface elevated by the convergence of three risk conditions. |
| Blast Radius | 2.13 / 10 | Blast is constrained by zero code execution, zero file system access, and zero deployment capability; API network egress and credential storage are the active drivers. |
| Attack Surface | 4.8 / 10 | The composite is elevated because untrusted input, sensitive data access, and external egress are all present across the default configuration. |
| Defense Controls | 7 / 15 | Vendor documents execution isolation and action controls at moderate tiers; input guardrails, output guardrails, and monitoring are documented at lower confidence. |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. Ada's reasoning loop processes untrusted end-user messages, operator knowledge sources, and authenticated API responses as first-class input across all connected channels.
Higher scores indicate wider exposure; Configuration carries the only evidence penalty from a confirmed infrastructure vulnerability.
Each row scores the surface from zero to four, with comments summarizing the documented input channel, tool capability, or orchestration boundary.
| Surface | Score | Comments |
|---|---|---|
| User Input | 2 / 4 | End-user messages from all connected channels reach the reasoning loop as first-class input, with prompt injection risk documented in industry frameworks for LLM-powered agents [4][13]. |
| External Data | 2 / 4 | Ada retrieves content from operator-configured knowledge sources and third-party APIs via Actions for real-time data ingestion into the reasoning loop [8]. |
| Memory | 1 / 4 | Conversation context is maintained within a session scope; no persistent cross-session memory store is documented in the default configuration [11]. |
| Reasoning | 2 / 4 | The multi-subsystem Reasoning Engine applies safety instructions and harmful content detection models, but independent red-team results are not publicly available [9]. |
| Planning | 2 / 4 | Operator-configured Processes and Playbooks define multi-step workflows; the agent follows structured plans rather than open-ended autonomous planning [8]. |
| Tool Execution | 2 / 4 | Ada Actions make authenticated API calls to external systems, including read and write operations that modify state in connected CRM and ticketing platforms [8]. |
| Orchestration | 2 / 4 | The Reasoning Engine orchestrates across knowledge retrieval, Actions, and conversation management subsystems within the vendor-managed infrastructure boundary [9]. |
| Inter-Agent | 0 / 4 | No documented multi-agent communication, delegation, or inter-agent messaging surface exists in the default Ada configuration [13]. |
| Output Processing | 1 / 4 | The agent emits text and structured API responses; vendor documents hallucination safeguards and response grounding but no independent output sanitization layer [7]. |
| Configuration | 2.5 / 4 | CVE-2024-9410 and its GitHub advisory mirror [1][2] confirmed blind SSRF through Sentry misconfiguration, documented by independent research [3]. |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Ada accepts untrusted end-user messages across multiple channels, holds authenticated access to customer data through CRM integrations, and makes outbound API calls to operator-configured endpoints.
Ada exhibits all three of these conditions in its documented default configuration:
- Untrusted input — Customer messages from all connected conversation channels including voice, email, chat, and social messaging enter the reasoning loop without documented prompt injection filtering [13].
- Sensitive data — Ada Actions access customer records and CRM data through authenticated API calls, with LLM inference processed by third-party subprocessors [8][14].
- External egress — Ada Actions make outbound HTTP calls to operator-configured API endpoints, and CVE-2024-9410 demonstrated infrastructure-level SSRF through misconfiguration [1].
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. A compromised Ada session can reach external APIs and stored credentials but has no code execution, file system, or deployment surface.
Higher blast scores indicate wider reach; Ada's active blast drivers are limited to network egress and credential storage from API Actions.
Each row ties a blast factor to the agent's documented workflow capabilities, authentication scopes, and autonomous action surface.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 0 / 4 | Ada has no code execution, shell access, or sandboxed interpreter surface; all processing runs on vendor-managed infrastructure with no operator-accessible execution boundary [7]. |
| File system access | 0 / 4 | No file system read, write, or artifact capability is documented; Ada operates as a stateless conversational agent within its vendor-managed boundary [13]. |
| Network access | 2 / 4 | Outbound HTTP requests from Actions reach operator-configured API endpoints, with LLM inference routed through third-party subprocessors under zero data retention [1][14]. |
| Credential access | 2 / 4 | Ada stores static API tokens and supports customer-login authentication for Actions; credential scopes are operator-managed across multiple connected integrations [8][10]. |
| Autonomous action | 1 / 4 | Proactive campaigns and scheduled messages are operator-configured; no fully autonomous actions fire without prior operator setup in the default configuration [13]. |
| Deployment access | 0 / 4 | Ada has no access to operator cloud infrastructure, infrastructure-as-code pipelines, or production deployment targets in the documented default configuration [7]. |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. Ada publishes SOC 2, HIPAA, and PCI compliance documentation and holds AIUC-1 certification, but per-component defense details rely on vendor-described architecture.
Higher defense scores indicate stronger vendor-implemented safeguards; most of Ada's controls are documented at the vendor tier without independent adversarial verification.
Each component is scored on the quality of vendor-documented controls versus independently verified safeguards on the default configuration.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 1 / 3 | Harmful content detection models and safety instructions are documented, with external findings accepted through a private disclosure program [9][12]. |
| Execution Isolation | 2 / 3 | Vendor-managed SaaS with tenant isolation and SOC 2 Type 2 compliance; Ada holds AIUC-1 certification requiring quarterly adversarial testing [5][6]. |
| Action Controls | 2 / 3 | Actions are restricted to Processes and Playbooks by default with per-action token scoping and access control restrictions; no single-step bypass is documented [8]. |
| Output Guardrails | 1 / 3 | Hallucination safeguards and response grounding are documented, but no independent DLP, redaction, or URL sanitization layer is described for the default output path [7]. |
| Monitoring | 1 / 3 | Conversation analytics and transcript logging with configurable retention are available; structured audit trails and active threat detection are not documented as default capabilities [6][11]. |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Operators should prioritize adding input filtering before the reasoning loop, restricting per-Action scopes to minimum permissions, and forwarding all logs to a central SIEM.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Require all customer-facing channels to route through an operator-managed prompt injection detection review before reaching the reasoning loop — counters User Input exposure at the default configuration.
- Configuration Configure channel-level input length limits and character set restrictions in the Ada dashboard — counters User Input and External Data ingestion of unconstrained payloads.
- Engineering Deploy a third-party prompt injection classifier as pre-processing middleware between channel integrations and the API — counters Input Guardrails gap where no independent testing is published.
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Establish a quarterly review cadence for SOC 2 Type 2 reports and penetration test summaries from the Trust Center — counters Execution Isolation reliance on vendor-managed controls.
- Configuration Enable all available tenant isolation settings and restrict API access to named IP allowlists — counters Execution Isolation dependency on vendor-managed network boundaries.
- Engineering Require evidence of tenant-level network segmentation and request-level authentication from vendor compliance artifacts — counters Execution Isolation dependency on vendor-managed boundaries without independent verification.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Require operator approval for any new Action configuration that includes write permissions to external systems — counters Credential Access from authenticated API calls.
- Configuration Restrict each Action's token scope to the minimum permissions required and rotate static tokens on a defined cadence — counters Credential Access across shared integrations.
- Engineering Implement a webhook-based approval gate for high-risk Actions such as payment processing or account modification — counters Action Controls reliance on operator-managed scoping.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Require DLP scanning of all responses before delivery to end users on channels that handle sensitive customer data — counters Output Guardrails gap at the default configuration.
- Configuration Enable transcript redaction settings for all sensitive field types and configure data retention to the minimum compliance window — counters output exposure in conversation logs.
- Engineering Wire a response-filtering proxy between Ada and downstream channels to detect and block credential leakage or PII in agent responses — counters Output Guardrails absence of DLP.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Require SIEM forwarding of all conversation logs and API audit events to the central security operations platform — counters Monitoring gap at the default logging tier.
- Configuration Configure data retention to the minimum window required by compliance and enable all available audit logging options — counters Monitoring at the basic logging tier.
- Engineering Build an anomaly detection pipeline monitoring conversation patterns for prompt injection indicators and unusual Action invocation rates — counters Monitoring absence of behavioral detection.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- CVE-2024-9410 Blind SSRF via Sentry misconfiguration on Ada.cx; CVSS 5.3; patched Oct 2024
- GHSA-vhp6-hrqq-rpqj GitHub Advisory mirroring CVE-2024-9410; moderate SSRF via Sentry endpoint; CWE-918
Selected Research
- Tenable TRA-2024-41 Tenable advisory documenting blind SSRF discovery and remediation on Ada.cx Sentry infra
- OWASP Top 10 for LLM Applications Industry framework covering prompt injection and excessive agency risks for LLM agents
- AIUC-1 Certificate Standard First AI agent security certification; Ada is founding contributor and first certified platform
Vendor Documentation
- Ada Trust Center SafeBase Trust Center with SOC 2 Type 2 and HIPAA reports and pen test summaries
- Ada Trust and Safety Vendor trust page on Reasoning Engine defenses and AIUC-1 certification and zero data retention
- Ada Actions Documentation Developer docs for API call config and token auth and access control restrictions
- Ada Reasoning Engine Docs Technical docs on Reasoning Engine architecture and safety instructions and adversarial testing
- Ada Privacy Policy Privacy policy documenting LLM provider zero data retention contracts with OpenAI and Azure
- Ada Data Retention Docs Conversation retention schedules and LLM zero retention enforcement and Data Compliance API
- Ada Vulnerability Disclosure Private invite-only disclosure program via Bugcrowd covering ada.cx and AI Agent Service
Other Sources
- Ada Platform Overview Omnichannel deployment across voice and email and chat and SMS and WhatsApp and Instagram
- Ada Subprocessor List Subprocessor list identifying LLM providers OpenAI and Azure OpenAI and Groq with locations