Research area · Threat modeling Agentic
Where agents cross trust boundaries: Modeling threats and making them testable
AI agents plan, call tools, and delegate work. As a result, threats arise in the agents' goals, memory, and interactions, not only in the code. We combine STRIDE for classic components with MAESTRO from the Cloud Security Alliance for the seven layers of agentic systems, model MCP landscapes, and translate threats into tests that fail when evidence is missing.
- MAESTRO
- STRIDE
- MCP threat modeling
- OWASP MCP Top 10
- MITRE ATT&CK & ATLAS
- Evidence Contract
- Automotive Threat Matrix
- Deep Dives
- 5
- Whitepapers
- 1
- Solutions
- 1
Why classic threat models fall short for agents
STRIDE, PASTA, and LINDDUN model software with predictable behavior. None of these methods systematically captures unpredictable agent behavior, goal misalignment, collusion between agents, or risks from the AI supply chain. For this purpose, the Cloud Security Alliance published MAESTRO on February 6, 2025: seven layers from Foundation Models to Agent Ecosystem, with Security and Compliance as a cross-cutting layer. The OWASP catalog of agentic threats provides the content for each layer.
With the Model Context Protocol, the trust boundary shifts to a place that classic models do not cover: tool descriptions and retrieved content determine at runtime which tool an agent calls. MCP deliberately comes without security mechanisms of its own; development and security teams have to enforce the usual controls themselves. For MCP landscapes, we therefore combine three lenses: STRIDE for the class of flaw, MAESTRO for the place in the architecture, and the OWASP MCP Top 10 (v0.1, Beta) as the risk catalog.
A threat model names dangerous transitions. Only telemetry shows whether an agent respects them in operation. In his paper accepted at ICSPIS 2026 (IEEE), Valeri Milke derives an Evidence Contract for MCP workflows from MAESTRO and STRIDE and tests it on 3,024 cells with six attack families. The study uses synthetic, deterministic fixtures; it clarifies the minimum evidence an evaluator needs to reconstruct a path and classify it as safe or unsafe.
Open questions in practice
- 01
Are STRIDE and PASTA sufficient for systems in which AI agents act autonomously?
Our approach
Not on their own. STRIDE lacks a view of AI-specific threats such as adversarial attacks, PASTA does not address attacks on models such as model extraction, and LINDDUN does not cover data poisoning. MAESTRO does not replace these methods but extends them: we use STRIDE for classic components and identify threats per MAESTRO layer and across layers, with the OWASP catalog as a checklist.
- 02
How do you model an MCP landscape in which tools are only chosen at runtime?
Our approach
We capture hosts, clients, connected servers, tools, and transport paths with explicitly marked trust boundaries. MCP itself sits on MAESTRO layer 3; we document threats per layer with STRIDE category, attack path, and reference to the OWASP MCP Top 10. Telemetry and repeat points ensure that the model grows with every new server and every release.
- 03
How does a threat become a verifiable test case for AI agents?
Our approach
Every dangerous transition becomes a tuple of boundary, precondition, invariant, evidence, and oracle. In an approval replay, the invariant requires the tool, arguments, principal, and target at invocation to match the approved values. The evaluator reports the violated rule and the first stage at which the evidence demonstrates it. Benign twins show whether a detector discriminates or merely raises constant alarms.
- 04
Can threat modeling be automated without losing explanatory power?
Our approach
Yes, if automation scales the analysis instead of replacing it. Threat modeling as code makes models versionable and reviewable in code review; generated threat lists remain a starting point. In VamiThreat, architecture descriptions become an editable data flow diagram with trust boundaries; the AI enriches and suggests, and your team reviews parsed diagrams before they are used.
Key takeaways
- 01
Agentic threats cascade across layer boundaries
MAESTRO decomposes agentic systems into seven layers, but threats across layer boundaries are particularly relevant: compromised framework libraries, access rights escalating between layers, goal misalignment of individual agents cascading into the ecosystem. The CSA approach provides a dedicated step for this, before risk assessment and mitigation planning.
Source: MAESTRO
- 02
Every reachable MCP server is a trust boundary of its own
MCP servers are mostly built by independent developers and distributed via unofficial registries; labels such as “official” or “verified” confirm neither identity nor a connection to the product. Many clients execute tools automatically and implicitly trust tool responses. A threat model therefore assesses provenance, auto-run behavior, and token scopes per server.
Source: Threat landscape
- 03
No risk catalog covers an MCP landscape on its own
The OWASP MCP Top 10 (v0.1, Beta) names ten documented risks, from Token Mismanagement to Context Over-Sharing; availability is missing as an entry of its own. Yet the disruption can come from your own agent: a model with an unbounded query tool generates expensive queries and load spikes. STRIDE therefore remains necessary as a grid so that no category slips through.
Source: MCP Threat Modeling
- 04
Complete evidence first for privileged operations
In the ICSPIS experiment, the threat-guided profile produced a median of 2,341 bytes of canonical JSON per workflow, 255.2% more than fragmented logs and 88.0% more than causal tracing. This is a serialization indicator, not a cost measurement. The consequence: complete records first for privileged operations, and sampling must not cut away Decision Receipts.
How we work
We combine established methods with agent-specific extensions. The result is not shelfware but a model from which measures, test cases, and telemetry requirements follow.
STRIDE & data flow diagrams
Six threat classes, each violating one security property, applied to data flows and trust boundaries — where threats concentrate.
MAESTRO from the Cloud Security Alliance
Seven layers from Foundation Models to Agent Ecosystem, with Security and Compliance as a cross-cutting layer; cross-layer chains as a separate work step.
OWASP catalogs
The catalog of agentic threats as a checklist per layer, the OWASP MCP Top 10 (v0.1, Beta) for MCP landscapes, and the OWASP Top 10 for Agentic Applications as a cross-check for the vocabulary.
Attacker taxonomies
MITRE ATT&CK for attacker techniques and ATLAS for attacks on AI systems, mapped per component in VamiThreat; for vehicles, the Automotive Threat Matrix as a path library.
Evidence Contract
Four stages — Input, Decision, Tool, Effect — with bindings whose equality or order a test oracle checks; the basis for negative tests and CI gates.
Threat modeling as code
Architecture and threat model as versioned code: reviewable in code review, repeatable in the pipeline, without replacing the joint analysis within the team.
How to get started
- 1Decompose the architectureCapture components, data flows, and trust boundaries and assign each component to a MAESTRO layer — in a workshop with your teams or alongside the development cycle.
- 2Assess threatsIdentify threats per layer and across layers, prioritize them by likelihood and impact, and derive a justified mitigation plan from them.
- 3Translate into testsCritical threats become testable hypotheses with an invariant and an oracle — negative tests with benign twins that fail in the pipeline when evidence is missing.
Deep dives, whitepapers, and analyses
Deep Dives 5
From research area to implementation
Related research areas
Agents in use — are the threats modeled?
In an initial consultation, we clarify where your agents, MCP servers, and data flows cross trust boundaries, and whether a workshop, ongoing modeling support, or VamiThreat is the best fit.