What's the security model for browser-native audio recording?

That's a worrying security hole, if you can record without getting any permission from the user -- sites could eavesdrop on visitors and upload the audio to who-knows-where (knowingly or not, via an XSS hole...).

I believe Flash needs to prompt you to access your microphone and webcam; browsers should too (even more so, because someone who has disabled all plugins may feel safer...).