Citizen/attacker ↔ chatbot

Exploit. Likely. Caller ID is attacker-controlled data and spoofing scales easily; voice cloning (TTS, conversion) is just as accessible. On an open crisis line with no authentication, trying costs nothing.

Impact high. Posing as a trusted source can trigger undue actions or credit and divert vital instructions; high rather than critical because no sensitive action is validated on the identifier or the voice alone.

Risk high. Likely times high stays high: CRM cross-checks, out-of-band verification and anti-spoofing with human escalation block the critical action, but do not reduce attempt volume on an open boundary.

Sources: AML.T0073 Impersonation · AML.T0088 Generate Deepfakes · Gabarit risk-voicebot

Exploit. Likely. Transcription is not a validated field: an adversarial phrase or a manipulated media stream (SIP injection, codec, inaudible payloads) gets through without any classic injection, on a voice channel open to anyone.

Impact critical. Making the system hear something other than what was said can silently trigger a high-impact action or corrupt a vital instruction: the effect is invisible to human listeners, hence critical impact.

Risk critical. Likely times critical stays critical: TLS/SRTP validation, media normalization and human fallback on sensitive intents bound the risk, but a manipulated stream can sabotage the model without being detected by ear.

Sources: AML.T0092 Manipulate User LLM Chat History · OWASP GenAI · Gabarit risk-voicebot

Exploit. Low. Repudiation is not an active attack: it needs alterable or missing evidence, and tamper-evident logging (immutable, encrypted, timestamped logs) makes denial hard to sustain.

Impact low. Denying what was said does not hurt directly: the stake is the dispute afterwards, not the vital instruction, as long as a contested decision can be reconstructed.

Risk medium. Low times low, but medium in a crisis context: an editable log proves nothing, and without proven immutable logging every contested decision becomes unverifiable; hence medium vigilance.

Sources: AML.T0092 Manipulate User LLM Chat History · MITRE ATLAS · Gabarit risk-voicebot

Exploit. Medium. Extraction needs no intrusion, one well-phrased question on a public line may suffice, but session and RAG isolation make cross-session reads non-trivial, hence Medium.

Impact critical. Leaking citizen data (identity, location, distress) or the system prompt mid-crisis means a serious privacy breach and vital instructions exposed to tampering.

Risk critical. Medium times Critical: citizen impact is maximal and the controls (isolation, least access, output redaction) are still unproven, hence Critical.

Sources: AML.T0085 Data from AI Services · AML.T0024 Exfiltration via AI Inference API · OWASP LLM02:2025 · LLM07:2025

Exploit. Likely. A public unauthenticated number, cheap robocalls and SIM farms; each voice call ties up more than a web request, hence Likely.

Impact critical. A saturated call channel mid-crisis means the service is unreachable and vital instructions no longer reach citizens, hence Critical.

Risk critical. Likely times Critical: reputation filtering, quotas and graceful degradation bound the intake, but the voice channel remains the saturable resource, hence Critical.

Sources: AML.T0029 Denial of AI Service · Gabarit risk-voicebot

Exploit. Medium. Just asking ("I am the admin") on a public line costs nothing; it is a dialogue property, not an ACL bug. If the backend refuses, nothing is granted, hence Medium.

Impact critical. Getting an unauthorized action (routing fraud, workflow escalation, write) on a crisis line can divert help or trigger wrong actions, hence Critical.

Risk critical. Medium times Critical: everything hinges on deterministic backend authorization, independent of the model's speech, plus a tool allowlist; until proven, Critical.

Sources: AML.T0051 LLM Prompt Injection · OWASP GenAI · Gabarit risk-voicebot

Exploit. Likely. Any caller can simply say "ignore your instructions": the attack needs no skill or access, and classic grids do not model a conversation input that has authority over the engine.

Impact critical. If the crisis instruction is overridden, the bot can deliver false vital guidance or divert its decision path on a line open to anyone, hence critical impact as long as the output is not blocked downstream.

Risk critical. High exploitability crossed with maximum impact: the risk stays critical until the control "no unfiltered output reaches a critical workflow" is proven by tracing an injection attempt.

Sources: AML.T0051.000 Direct · OWASP LLM01:2025 Prompt Injection · Gabarit risk-voicebot

Exploit. Medium. The attack rides a secondary channel (transcription, fetched content, inaudible sounds), which takes more setup than a direct request, but a vector inaudible to humans is still a real input to the model.

Impact critical. Content injected without the caller's knowledge can steer the guidance delivered mid-crisis, with the document-context-decision chain escaping classic input controls.

Risk critical. Critical impact and an open vector as long as transcription is unfiltered: despite medium exploitability, the crossing stays critical without upstream audio channel filtering.

Sources: AML.T0051.001 Indirect · OWASP LLM01:2025 Prompt Injection · Gabarit risk-voicebot

Exploit. Likely. Attacks on the model's policy are frequent and hard to eradicate by instruction hardening alone; roles, negotiation and encodings are within any caller's reach.

Impact critical. A model pushed out of its policy can utter guidance contrary to the crisis protocol or expose citizen data, on a service reachable by anyone.

Risk critical. A frequent attack with maximum impact: the risk stays critical until critical actions and decisions are kept outside free generation, the sheet's central proposed control.

Sources: AML.T0054 LLM Jailbreak · OWASP GenAI · Gabarit risk-voicebot

Exploit. Medium. Anyone can call the service, and hallucination arises in the model's free generation; but it is a probabilistic output, not reliably triggerable by the caller, so exploitability is medium.

Impact critical. An invented vital instruction, wrong emergency number, false evacuation advice or fabricated escalation fact, directly drives a distressed citizen's action; the impact is life-safety, so critical.

Risk critical. Medium exploitability, life-safety impact: until high-impact outputs are proven to run on deterministic logic outside the model, a plausible but false answer can drive the critical path; risk stays critical.

Sources: AML.T0060 Publish Hallucinated Entities · OWASP LLM09:2025 Misinformation

Exploit. Low. Poisoning requires writing into the knowledge base or the supply chain, a slow and diffuse act; with strictly approved ingestion and no caller speech fed back, the direct path is closed, so exploitability is low.

Impact critical. Once knowledge is contaminated, all future answers are durably influenced: false vital instructions spread at scale, invisible call by call; the impact is critical.

Risk critical. Low likelihood, but critical and persistent impact: a single contamination replicates into every future answer, and the controls, approved ingestion, artifact digests, must be proven; the crossing stays critical.

Sources: AML.T0070 RAG Poisoning · AML.T0020 Training Data Poisoning · OWASP LLM04:2025 Data and Model Poisoning

Exploit. Low. Triggering an external action must cross the injection filter, policy engine and workflow execution, then deterministic per-tool backend authorization; caller speech alone is not enough, so exploitability is low.

Impact critical. If an action gets through, unauthorized write, privilege escalation or workflow abuse, it executes in the real world, such as a false alert escalation or a write into a crisis system; the impact is critical.

Risk critical. Low likelihood but critical, irreversible impact, since the action is executed; risk stays critical until it is proven, tool by tool, that only a deterministic backend authorizes the action.

Sources: AML.T0053 AI Agent Tool Invocation · OWASP LLM06:2025 Excessive Agency