1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. Parloa's default configuration routes untrusted voice input into the LLM reasoning loop, connects to sensitive CRM and payment systems, and relies on vendor-documented controls with no independently verified injection detection.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Parloa's managed SaaS architecture constrains blast radius to integration-scoped exposure while the trifecta-floored attack surface reflects the convergence of untrusted voice input, sensitive data, and outbound communication.
The score pattern places Parloa at the controlled end of the Tight Operators quadrant, where the managed SaaS boundary that eliminates code execution and file system access counterbalances the trifecta-driven attack surface floor, producing a profile where the primary residual risk sits in the integration layer rather than in host-level compromise.
The evidence base draws entirely from vendor-documented controls, class-level voice agent security research, and framework-level threat taxonomies, with no agent-specific vulnerability disclosures, independent audit findings, or named security research to anchor per-component scores above the inferred tier.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 2.28 | The defense multiplier from vendor-documented Subtask Agent restrictions, Azure infrastructure isolation, and centralized audit logging partially offsets the trifecta-floored attack surface, producing a residual-risk indicator that reflects a managed SaaS agent whose integration surface presents measurable risk even without code execution capability. The evidence base relies on vendor documentation for defense-tier grounding and class-level voice injection research for attack-surface calibration, with no agent-specific vulnerability disclosures to anchor higher-severity claims. |
| Blast Radius | 2.13 / 10 | The absence of code execution, file system access, and deployment capabilities constrains the blast radius to API-level operations within the configured integration mesh. A compromised agent can read and write CRM records, trigger payment processing, and send voice and text responses to callers, but cannot escalate to the operator's host, file system, or infrastructure. The network and credential-adjacent factors carry the score, while session-bound autonomous action within human-in-the-loop gated workflows limits the scope of unsupervised operations. |
| Attack Surface | 4.8 / 10 | The raw weighted score from ten surfaces sits below the midpoint, but all three trifecta conditions converge in the same agent session: untrusted voice caller audio enters the reasoning loop, sensitive CRM and payment data is accessible through configured integrations, and outbound API calls plus voice responses provide egress channels. The trifecta floor reflects this architectural convergence. Class-level research on auditory prompt injection and near-ultrasound covert injection demonstrates that the voice channel is a viable attack vector against speech-driven LLM agents. |
| Defense Controls | 8 / 15 | Vendor-documented controls span workflow-level input gating through Subtask Agent deterministic restrictions, Azure cloud infrastructure isolation with Key Vault secrets management, automatic PII redaction on output streams, and centralized audit logging with SOC 2 Type II attestation. Every component scores at the vendor-documented confidence tier, with no independently published penetration testing results, no documented prompt injection detection methodology, and no active behavioral anomaly detection to move confidence above the inferred level. The defense profile is consistent with a managed SaaS vendor in a compliance-oriented posture. |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. The dominant exposure is the multi-channel voice input path where untrusted caller audio enters the reasoning loop without a documented injection detection layer, feeding the same prompt context across phone, chat, and messaging channels.
Higher scores indicate broader attacker-controllable input surfaces feeding into the reasoning loop; the voice-first architecture concentrates exposure in the user input and tool execution integration layers.
Each row maps an attack surface to its score and a Comments cell summarizing the condition, evidence, and the default-configuration exposure the operator inherits.
| Surface | Score | Comments |
|---|---|---|
| User Input | 2 / 4 | Untrusted caller audio from phone lines, web chat, and messaging feeds directly into the model reasoning context with no documented injection filter on any channel. The platform documents multi-channel input handling but no dedicated prompt-injection detection or filtering layer for voice input. Research demonstrates imperceptible auditory prompt injection achieving high hijack success rates across production voice models [2], and inaudible near-ultrasound covert injection against speech-driven LLMs under black-box conditions [4]. |
| External Data | 2 / 4 | Agents retrieve customer records and knowledge base content through configured CRM, ERP, and knowledge skill integrations rather than arbitrary untrusted web content [10]. The integration surface spans multiple enterprise systems that could serve as indirect injection vectors if upstream data sources are compromised. No documented input validation layer screens data retrieved from integrated systems before it enters the reasoning context [12]. |
| Memory | 2 / 4 | The Conversation Store provides persistent storage of all conversation data including transcripts and metadata, retrievable via a structured API [6]. Cross-session context can be passed through integration data, but agents do not self-modify or auto-learn without explicit designer retraining cycles. The memory surface is bounded by the vendor's managed storage layer rather than filesystem-backed memory that an attacker could directly write to [9]. |
| Reasoning | 2 / 4 | The platform uses a model-agnostic orchestration layer delegating reasoning to interchangeable external LLMs through a managed API boundary. Two-layer routing in Subtask Agents constrains which workflow stages the model can access through deterministic restrictions combined with LLM-driven activation instructions [8]. The reasoning boundary is the configured skill and integration scope rather than unrestricted model inference [7]. |
| Planning | 2 / 4 | Subtask Agent orchestration decomposes conversations into multi-step workflow stages with deterministic restrictions controlling transitions between stages [8]. Planning complexity is bounded by designer-configured agent composition rather than open-ended recursive planning, and each subtask operates within its authorized scope. No autonomous goal-seeking, recursive self-improvement, or unbounded planning loops are documented in the platform architecture [7]. |
| Tool Execution | 2 / 4 | Agents call REST APIs, GraphQL endpoints, and configured connectors to CCaaS, CRM, ERP, and CPaaS systems but do not execute shell commands, arbitrary code, or browser automation [10]. PCI-compliant DTMF collection handles payment card processing within the platform boundary. The tool surface is constrained to the configured integration mesh rather than general-purpose execution, limiting the attacker's ability to pivot beyond the integration endpoints [6]. |
| Orchestration | 2 / 4 | Multi-agent orchestration operates through Subtask Agents within a single conversation session, with Agent Composition enabling cross-region and cross-language adaptations [8]. Simulation and evaluation agents provide pre-deployment testing but operate in the same managed environment [13]. No background execution, cron scheduling, or daemon operation is documented, and agents are session-bound to customer interactions, limiting the orchestration attack surface to active sessions [7]. |
| Inter-Agent | 1 / 4 | Subtask Agents communicate within the managed platform through a controlled vendor-owned protocol with deterministic restrictions governing activation [8]. No external agent connectivity, open protocol bridges, or marketplace for third-party agent plugins is documented. The inter-agent surface is limited to internal platform communication between designer-configured agents, with no pathway for externally authored agents to join the orchestration [7]. |
| Output Processing | 1 / 4 | Output is primarily voice and text responses to callers via phone, chat, and messaging channels with PII redaction documented as a default output control [6]. No rich rendering, markdown injection, or URL embedding in output is applicable given the voice-first architecture. The Transcripts API provides structured data export rather than free-form output channels, limiting the output processing attack surface to the voice and text response path [9]. |
| Configuration | 1 / 4 | Agent configuration occurs through Parloa Studio, a managed design interface, rather than auto-loaded configuration files from untrusted sources [7]. Skills and integrations come from the vendor's managed ecosystem with no public marketplace for community-authored configurations. The configuration supply chain surface is constrained to the vendor's own tooling and certified integration partners rather than open-source dependencies or community plugins [10]. |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Parloa exhibits all three on the documented default: a voice caller's injected instruction can access CRM customer records and payment data through configured integrations and transmit the results back through the voice response channel, chat, messaging, or integration-triggered API calls without crossing a documented exfiltration control.
Parloa exhibits all three of these conditions in its documented default configuration:
- Untrusted input — Arbitrary caller audio from public phone lines enters the model reasoning context on every configured channel, and the platform documents no dedicated prompt-injection detection or ML-based injection classification layer for voice input [2][3][4].
- Sensitive data — Agents access customer records through CRM integrations, handle payment card transactions within PCI-regulated channels, and manage protected health information in healthcare deployments, with the Conversation Store retaining full conversation data including sensitive caller information [1][6].
- External egress — Agent responses flow directly to callers via voice, chat, and messaging channels, configured integrations trigger outbound API calls to CRM and ERP systems, and the Transcripts API exports conversation data to external analytics platforms [10][5].
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. The managed SaaS boundary eliminates code execution and file system exposure entirely, constraining the blast radius to integration-scoped API calls, credential-adjacent CRM data access, and session-bound conversation handling.
Higher scores indicate broader damage capability after compromise; the managed cloud architecture zeros out host-level factors while the integration mesh carries the residual network and credential exposure.
Each row maps a blast factor to its score and an analyst comment describing the damage a compromised agent can inflict within that factor's scope.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 0 / 4 | Parloa agents do not execute arbitrary code, shell commands, or scripts within the platform runtime [7]. No code interpreter, sandbox, or execution environment is exposed to the agent, and the managed SaaS boundary prevents the agent from reaching the underlying host operating system. The code execution blast factor is absent by architectural design rather than by a configurable sandbox [9]. |
| File system access | 0 / 4 | Agents have no file system access within the platform boundary [9]. Conversation data is stored in the vendor's Conversation Store and accessed through structured APIs rather than file system operations. The managed Azure infrastructure isolates the agent runtime from any filesystem layer, eliminating this factor entirely [7]. |
| Network access | 2 / 4 | Agents make outbound API calls to configured integration endpoints spanning CRM, ERP, CCaaS, and CPaaS systems [10]. Network access is domain-restricted to the configured connector set rather than arbitrary outbound connections, but the integration surface handles sensitive enterprise data across multiple systems. No documented network segmentation between integration endpoints limits lateral movement within the authorized integration mesh [6]. |
| Credential access | 2 / 4 | Through configured integrations agents access customer records in CRM systems, process payment card data under PCI DSS scope, and handle protected health information in healthcare deployments [1][9]. Credential-adjacent data exposure is bounded by Subtask Agent restrictions and integration configuration rather than unrestricted credential store access, but the scope of accessible data within authorized workflow stages can include sensitive financial and medical records [6]. |
| Autonomous action | 1 / 4 | Agents handle customer conversations autonomously within configured workflow parameters with human-in-the-loop workflows gating sensitive use cases and deterministic restrictions preventing unauthorized stage transitions [8][13]. No unattended background execution, scheduled tasks, or daemon operation is documented, bounding the autonomous action factor to active conversation sessions under the two-layer routing control [7]. |
| Deployment access | 0 / 4 | Agents have no deployment, infrastructure management, or publish capability within the platform [7]. Configuration occurs through Parloa Studio by authorized administrators rather than through the agent runtime, and no CI/CD pipeline access or self-modification capability is documented in the platform architecture [9]. |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. Vendor-documented controls span workflow-level input gating, Azure infrastructure isolation, and centralized audit logging, but no independently verified prompt injection detection or output exfiltration controls raise confidence above the vendor-documented tier.
Higher scores indicate stronger controls at the documented default; all five components score at vendor-documented confidence with no independent audit results published to raise the confidence tier.
Each row maps a defense component to its score, confidence tier, and a Comments cell describing what is in place or absent at the default configuration.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 1 / 3 | Subtask Agent deterministic restrictions gate which workflow stages the LLM can access based on variable checks, and PII redaction filters input and output streams [6][8]. No dedicated prompt-injection detection, ML-based injection classification, or voice-input content filtering is documented for any channel. The vendor references guardrails in product documentation but does not specify the injection-detection methodology or provide testing results that would move the confidence tier above vendor-documented [11][13]. |
| Execution Isolation | 2 / 3 | Azure cloud infrastructure provides network isolation, Key Vault integration for secrets management, and multi-tenant data isolation with regional data residency controls [9]. The agent runtime does not execute arbitrary code, so the isolation boundary is the managed cloud environment rather than an agent-side sandbox. External penetration testing is documented as a practice but results are not published and no independent audit reports are available [6]. |
| Action Controls | 2 / 3 | Subtask Agent deterministic restrictions make unauthorized workflow stages invisible to the LLM before inference runs [8]. Human-in-the-loop workflows gate sensitive use cases per vendor documentation [13]. No documented single-step bypass mechanism exists, and actions are scoped to configured skills and integration endpoints rather than open-ended tool use. The two-layer routing architecture represents a substantive control beyond simple instruction-level constraints [7]. |
| Output Guardrails | 1 / 3 | Automatic PII redaction is documented for output streams and the Transcripts API provides anonymized transcript access options [6]. No dedicated data-loss prevention, exfiltration channel blocking, or output content filtering beyond PII patterns is documented for the voice and text response channels. The primary output surface is caller-facing voice and text, which limits but does not eliminate the exfiltration risk path [9]. |
| Monitoring | 2 / 3 | Centralized audit logs track configuration changes and platform events, the Conversation Store maintains a full interaction audit trail, and SOC 2 Type II attestation covers operational security monitoring controls [1][9]. No runtime anomaly detection, automated containment workflows, or real-time suspicious behavior alerting is present in the documented default. The distance between extensive logging and operationally useful security alerting remains the operator's primary blind spot [6]. |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. The default configuration leaves prompt injection detection, output exfiltration controls, and behavioral anomaly monitoring as opt-in measures that operators must layer on top of the vendor-documented posture.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Require vendor disclosure of the prompt-injection detection methodology and independent testing scope before deploying agents on voice channels that handle sensitive data — counters the undocumented injection detection methodology on the default input path.
- Configuration Deploy a dedicated ML-based prompt-injection classifier before the LLM reasoning loop for all input channels including voice STT output — counters the absence of documented injection detection on the default voice input path.
- Engineering Implement input length limits and content-type validation on all channels to constrain the injection surface available to callers — counters the open multi-channel input surface feeding untrusted bytes into the same reasoning context.
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Request and review the vendor's external penetration testing reports to verify that the Azure infrastructure isolation matches the documented architecture — counters the vendor-documented confidence tier on execution isolation.
- Configuration Restrict network egress from the agent runtime to only the specific integration endpoints required for each deployment — counters the broad integration surface connecting to multiple CRM, ERP, and CCaaS systems.
- Engineering Implement API gateway policies to monitor and rate-limit outbound API calls from agent sessions — counters the risk of integration endpoint abuse through compromised agent conversations.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Enforce minimum-privilege Subtask Agent restrictions for each workflow stage, ensuring agents access only the CRM fields and endpoints required for their specific task — counters the broad integration scope within authorized stages.
- Configuration Enable human-in-the-loop approval for all actions that write to CRM systems, trigger payment processing, or modify customer records — counters autonomous action capability within authorized workflow boundaries.
- Engineering Implement session-level action budgets that cap API calls, CRM writes, and payment operations per conversation — counters the absence of per-action rate limiting within authorized workflow sessions.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Establish data-loss prevention policies covering agent output channels to detect sensitive data patterns beyond PII including API keys, internal identifiers, and system prompts — counters the absence of documented DLP or exfiltration controls.
- Configuration Configure output content filtering to suppress responses containing prompt leakage, system prompt fragments, or internal configuration details — counters the risk of system prompt exfiltration through voice or text response channels.
- Engineering Configure Transcripts API access controls to enforce least-privilege access and audit all transcript retrieval operations — counters the broad data access surface through programmatic transcript retrieval.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Establish real-time alerting rules for high-risk agent behaviors including unexpected CRM writes, payment anomalies, and human-in-the-loop bypass attempts — counters reliance on retrospective log review for incident detection.
- Configuration Configure SIEM forwarding for all audit log events and conversation-level anomaly signals — counters the absence of active anomaly detection on the default monitoring configuration.
- Engineering Implement behavioral anomaly detection on conversation patterns to identify potential prompt injection, data exfiltration attempts, or unusual API call sequences — counters the distance between extensive audit logging and operationally useful alerting.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- Parloa Trust Center The vendor operates a Trust Center with SOC 2 Type 1 and Type 2 reports and PCI DSS AOC but publishes no CVE advisory list or vulnerability disclosure page.
Selected Research
- AudioHijack: Hijacking Large Audio-Language Models Imperceptible auditory prompt injection achieves 79-96 percent hijack success across 13 voice models including production agents.
- AudioJailbreak: Jailbreak Attacks against LALMs Asynchronous and over-the-air audio jailbreak attacks bypass GPT-4o-Audio and Llama-Guard-3 safeguards.
- SWhisper: Inaudible Covert Prompt Injection First practical covert prompt injection via commodity near-ultrasound channel against speech-driven LLMs.
- Three-way risk convergence in AI agents Simon Willison defines the critical risk combination as private data plus untrusted content plus external communication.
Vendor Documentation
- Parloa Security Page Documents encryption at rest and in transit and RBAC and external pen testing and PII redaction as default platform capabilities.
- Parloa Platform Overview AI Agent Management Platform supports design and test and deploy and monitor lifecycle stages with Parloa Studio.
- Parloa Subtask Agents Two-layer routing combines deterministic restrictions with LLM-driven activation preventing unauthorized workflow stages.
- Parloa Data Isolation Azure infrastructure with network isolation and Key Vault integration and automatic PII redaction and data residency controls.
- Parloa Integrations Integrates with CCaaS and CRM and ERP systems including Avaya and Five9 and Genesys and Salesforce and ServiceNow and SAP.
Other Sources
- OWASP Top 10 for LLM Applications 2025 Covers prompt injection and sensitive information disclosure and excessive agency and system prompt leakage as top LLM risks.
- Unit 42: Indirect Prompt Injection in the Wild Palo Alto Networks documents web-based indirect prompt injection attacks observed in production against AI agents.
- Parloa AI Guardrails for CX Describes simulation agents and evaluation agents and human-in-the-loop workflows as guardrail layers.