1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. Replicant's default configuration exposes untrusted voice and text input to LLM reasoning with moderate vendor-documented defenses but no published prompt-injection testing or execution-isolation architecture.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Replicant's composite score reflects a trifecta-elevated attack surface constrained by a narrow blast radius and moderate vendor-documented defenses.
Replicant occupies the Tight Operators quadrant with attack surface scoring 4.80, blast radius scoring 2.50, and defense controls totaling 7 out of 15.
The table below summarizes four axes: Attack Surface and Blast Radius each scored out of 10, Defense Controls out of 15, and the composite AIRQ score.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 2.5 | Low composite driven by constrained blast radius, but the trifecta-complete posture means operators should prioritize input-channel hardening despite the low headline score. |
| Blast Radius | 2.5 / 10 | Constrained to the integration layer with no documented code execution, file system access, or cloud infrastructure reach from the agent runtime. |
| Attack Surface | 4.8 / 10 | Elevated by the trifecta floor; individual surface scores are low but the combination of untrusted voice input, sensitive data, and telephony egress triggers the minimum. |
| Defense Controls | 7 / 15 | Multiple compliance certifications and documented PII redaction provide a moderate baseline, but input-filtering and isolation details remain undisclosed. |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. Replicant's reasoning loop ingests untrusted caller audio and free-text chat as first-class input, with pre-configured CRM and ERP integrations as secondary data sources.
Higher scores indicate broader attacker-reachable surface; Replicant's user input and reasoning axes score highest due to the live audio ingestion pipeline.
Each row maps an attack surface to a score and a prose comment describing the documented input channel and its exposure on the default configuration.
| Surface | Score | Comments |
|---|---|---|
| User Input | 2 / 4 | Processes inbound voice, chat, and SMS messages from untrusted callers, with adversarial audio injection demonstrated against comparable voice pipelines [2][8]. |
| External Data | 1 / 4 | Retrieves CRM and ERP records via pre-configured integrations; no documented arbitrary URL retrieval or web-fetch capability [7]. |
| Memory | 1 / 4 | Maintains in-conversation context for multi-turn dialogues; no documented cross-session persistent memory or vector store [8]. |
| Reasoning | 2 / 4 | Combines LLM inference with code-based guardrails for conversation flow; reasoning-loop prompt injection is a documented class-level risk [6][10]. |
| Planning | 2 / 4 | Follows operator-configured conversation flows with branching logic; no documented autonomous goal decomposition beyond scripted paths [8]. |
| Tool Execution | 1 / 4 | Invokes pre-configured API integrations for CRM writes, payment processing, and scheduling; no arbitrary code or shell execution [7]. |
| Orchestration | 2 / 4 | Coordinates multiple LLM and guardrail components within a single conversation turn; orchestration boundaries are vendor-managed [6]. |
| Inter-Agent | 1 / 4 | Supports handoff to human agents via CCaaS integration; no documented agent-to-agent message passing or multi-agent delegation [7]. |
| Output Processing | 1 / 4 | Generates voice responses via TTS and text replies via chat and SMS; output rendering is handled by the telephony platform [8]. |
| Configuration | 1 / 4 | Operator-configured via the Replicant console with RBAC and MFA access controls; no documented API keys exposed to agent runtime [5]. |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Replicant reads untrusted caller audio into LLM inference, accesses customer PII and payment records through integrations, and sends outbound voice and SMS responses to external parties.
Replicant exhibits all three of these conditions in its documented default configuration:
- Untrusted input — Untrusted callers supply voice and text content that the speech-to-text pipeline transcribes directly into the LLM reasoning loop [4].
- Sensitive data — The agent accesses customer PII, payment information, and account records through CRM and ERP integrations during live conversations [9].
- External egress — Outbound voice responses, SMS messages, and structured CRM writes transmit data outside the operator trust boundary to external parties [11].
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. A successful compromise of Replicant reaches the integration layer including CRM writes, payment actions, and outbound telephony, but not code execution, file systems, or cloud infrastructure.
Higher blast scores indicate broader damage potential from a compromised conversation; Replicant's reach is bounded by its pre-configured integration endpoints.
Each row maps a blast factor to the agent's documented capabilities, scoring the operational reach a compromised session could achieve through that channel.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 0 / 4 | No documented code execution, shell access, or browser automation capability exists in the Replicant agent runtime [6]. |
| File system access | 0 / 4 | No documented file read, write, or artifact storage capability is accessible from the agent conversation layer [6]. |
| Network access | 2 / 4 | Outbound network reach is limited to pre-configured API endpoints for CRM, ERP, and telephony systems; no arbitrary HTTP surface documented [7]. |
| Credential access | 2 / 4 | Integration credentials for CRM, ERP, and payment systems are managed through the vendor platform with operator-configured scoping [5]. |
| Autonomous action | 2 / 4 | The agent performs payment processing, appointment scheduling, and record updates autonomously during conversations without per-action operator approval [8]. |
| Deployment access | 0 / 4 | No documented access to operator cloud infrastructure, infrastructure-as-code pipelines, or production deployment targets [6]. |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. The vendor holds multiple compliance certifications and documents PII redaction with role-based access, but input-filtering specifics and isolation architecture are not publicly disclosed.
Higher defense scores indicate stronger vendor-implemented safeguards on the default configuration; lower scores indicate controls that are absent or undisclosed.
Each component is scored reflecting whether the vendor implements the control by default or leaves it to the operator to configure independently.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 1 / 3 | The vendor documents topic-restriction guardrails and operates a disclosure program [1] but no independent assessment validates these controls [5]. |
| Execution Isolation | 1 / 3 | Cloud-hosted with SOC 2 Type 2 compliance; tenant-isolation details are not disclosed, and red-teaming frameworks identify comparable voice agents as undertested [3][5]. |
| Action Controls | 2 / 3 | Operator-configurable conversation flows with RBAC restrict which actions the agent can perform; per-action approval gates are available but not default-on [5]. |
| Output Guardrails | 1 / 3 | PII redaction is documented for conversation transcripts; output-sanitization controls for URL injection or markup in chat responses are not publicly detailed [9]. |
| Monitoring | 2 / 3 | Real-time conversation transcripts, analytics dashboards, and audit logging are documented; SIEM forwarding and anomaly detection are operator-managed [6]. |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Operators should prioritize breaking the trifecta posture by adding input-channel prompt-injection filtering and constraining autonomous action scopes on the default configuration.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Require all inbound caller interactions to pass through an approved prompt-injection review gate before reaching the LLM reasoning loop.
- Configuration Configure input-length limits and character-set restrictions on chat and SMS channels within the Replicant console to reduce injection surface.
- Engineering Deploy a real-time audio anomaly classifier upstream of the speech-to-text pipeline to flag adversarial audio patterns before transcription.
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Require the vendor to provide tenant-isolation architecture documentation and penetration test attestation before production deployment.
- Configuration Configure network segmentation between the Replicant agent runtime and internal systems to limit lateral movement on compromise.
- Engineering Instrument the agent runtime boundary with egress-traffic monitoring to detect unexpected outbound connections from the execution environment.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Require operator approval for high-value autonomous actions including payment processing and account modifications above a defined monetary threshold.
- Configuration Configure per-integration action allowlists in the Replicant console to restrict which CRM and ERP write operations the agent may invoke.
- Engineering Implement a transaction-signing mechanism for payment actions that requires a secondary verification step before funds transfer completes.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Require all outbound chat and SMS messages to pass through a DLP scanner before delivery to detect sensitive data leakage.
- Configuration Configure URL and markup sanitization on the chat output channel to prevent injection of malicious links into customer-facing responses.
- Engineering Deploy an output-content classifier that flags agent responses deviating from expected conversation patterns for manual review before delivery.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Require forwarding of all conversation audit logs to the SIEM platform with alerting rules for anomalous interaction patterns.
- Configuration Configure real-time alerting on the analytics dashboard for conversations exceeding normal duration, transfer rate, or error thresholds.
- Engineering Instrument the integration API layer with request-level logging and anomaly detection to identify credential misuse or unusual data access patterns.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- Replicant Vulnerability Disclosure Program Vendor disclosure program with GPG-signed contact; no monetary bounty
Selected Research
- AudioHijack — Adversarial Audio Prompt Injection Adversarial audio injection against voice agents; 79-96 percent success rate
- Aegis — Red-Teaming Framework for Voice Agents First systematic red-teaming framework for voice agent security
- SWhisper — Covert Prompt Injection via Speech Inaudible prompt-delivery attacks against speech-driven LLMs
Vendor Documentation
- Replicant Security and AI Safety SOC 2 Type 2 and PCI DSS and HIPAA and GDPR compliance plus PII redaction and RBAC
- Replicant Platform Architecture Multi-agent architecture with code-based guardrails and auditing
- Replicant Integrations CCaaS and CRM and ERP and iPaaS and POS and telephony integrations
- Replicant Conversation Automation Voice and chat and SMS omnichannel automation capabilities
- Replicant Privacy Policy Data handling and encryption and cross-border transfers and CCPA and GDPR retention
Other Sources
- OWASP Top 10 for LLM Applications Prompt injection and excessive agency and sensitive disclosure for LLM agents
- MITRE ATLAS Adversarial threat framework with Agent Context Poisoning techniques